{ "Event": { "published": true, "date": "2026-04-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-01", "timestamp": 1775088181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3ebd57d1-6fd8-42e8-9c73-b6f8a6089bd7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ee507e-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775040831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040831, "uuid": "26c4689f-2047-4673-b1c9-8e125d35946c", "comment": "Malware payload (AsyncRAT)", "value": "32066ff6369a7bd794f03bdb77c399f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040831, "uuid": "6f65b549-3d4a-44af-9503-823721d4ebf9", "comment": "Malware payload (AsyncRAT)", "value": "0001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040831, "uuid": "3d5f0ab8-9405-4e1b-a86d-b0bc857a36b5", "comment": "Malware payload (AsyncRAT)", "value": "eb6d37eb6380196c2cec25c1f4c1facd3fb789de", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040831, "uuid": "66366269-4b21-443b-9ed8-a83726e2b4d7", "comment": "Malware payload (AsyncRAT)", "value": "4dc9440e095817e2f27867468f9b892203d16848dc3124ece6389fbab73ac1bc20ee4adfb5d143db9839850ba73b282d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040831, "uuid": "f119a908-bf28-4dac-aa04-e5f712a12bd5", "value": "T134269E0166C6D779D1684A70C866827363F8F6803B304BD732B4A7692D2BEE49D7372D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040831, "uuid": "9a63e37a-cefe-434d-872a-a7af0a0f169d", "value": "49152:8m/G+jc43x206oI4wmVNghL+Wt/S1XKuVXSu95d/aclpPq/z:R/G+jc43D6FV+Wt/SpZXSkT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040831, "uuid": "a2bd2443-88db-439a-89c0-3cacdeb0cfb7", "value": 4486656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040831, "uuid": "f896c655-dc5a-4aa7-96f9-e9cd6549e67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040831, "uuid": "26878c61-9244-4cc9-bff7-54b67167780d", "value": "0001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca50e9ac-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775060468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060468, "uuid": "db6f23c0-7f46-4700-be5b-60acbe6c8150", "comment": "Malware payload", "value": "e63418d7616c166dfd07f8d26967b9c4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060468, "uuid": "28d55405-e162-457a-a20f-2e2c90462508", "comment": "Malware payload", "value": "007167017d6cc0f8850368f28a74218c19d2d65b00b6d7899e59ba96cbb0b9ad", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060468, "uuid": "8838e6c8-0978-406b-8e27-480e0209cb48", "comment": "Malware payload", "value": "66a091a4f647d8313dc774e15c7b9de154594cf7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060468, "uuid": "5662befe-cb15-4a87-9e68-723842cb8791", "comment": "Malware payload", "value": "4ae235e76e78d3990182d2b033a491c8794ac6945374b95311c00b8e111d97b84b7f98fee3b3e211daebbb6af424ad1f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060468, "uuid": "a0314d06-a807-46a5-9f5a-eba959a78ceb", "value": "T199A3E021E27198C006F871D24A972885375CD4D307F1CDDE6A271CB6A9BD63BDE09BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060468, "uuid": "be14820d-e624-4bcd-8519-d7ae70b336b8", "value": "3072:42qGtWuId7G0b1nF+rwJTGMIPV1xjy7RY2:42qGtWu4rnFBg1xjy762", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060468, "uuid": "3bb32f5c-7f66-41d9-87da-d8f9a83e2549", "value": 100459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060468, "uuid": "0d01b71a-1ae6-42c8-a412-c3276562cbf0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060468, "uuid": "4c3c6db5-7595-45ff-aba5-e8a4d4eaa075", "value": "yea.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63de834-2d93-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775024786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024786, "uuid": "ed3f6305-4dcf-416f-b900-c8aae69a9205", "comment": "Malware payload (CountLoader)", "value": "7f7248736f8e48fd4d006c5bc79d91e0", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024786, "uuid": "f03f39d3-c439-4591-8a05-15fecdaf2e1b", "comment": "Malware payload (CountLoader)", "value": "00ae5025e408d3f62b9f2241ce088201530c2b50d1f1028144bdb1969e60a8be", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024786, "uuid": "c31bd308-98b3-448a-b296-7b28bb3ea082", "comment": "Malware payload (CountLoader)", "value": "93fb2a4e5dd2897053b749e8c569d0c2b80b195b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024786, "uuid": "fc930a31-5eef-403b-bec7-02ad2e9ea758", "comment": "Malware payload (CountLoader)", "value": "75f263c5aef8fa3fd9f32c9d23c8debd07d79ea9dc14e9900eb222dc0b3e9d029ce8bc2fe38fee78c20646636d6a6bcc", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024786, "uuid": "8c537336-53d6-48c2-a041-c7dd22682d74", "value": "T1CC04AFDC899AC4A04B5F24240F6A2C534FCDE1234B1DD991BAEF9F943F426A0717DAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024786, "uuid": "ca1876a9-f905-4035-8216-033c94921e09", "value": "768:gizpqwWRo8NKMD5mzQsV87mlB96I1qrekRb5obhtDTP/FobmjILS6d6l6I6C6bPp:mw+K8olsBBfl1OgldLGI/xnSQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775024786, "uuid": "c9ba0473-27ad-4048-9f55-8b2377f1ee18", "value": 179202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775024786, "uuid": "60fe253b-8eb3-41b5-9a20-6fec3e21347d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024786, "uuid": "5a2e2963-5b4d-42dc-a7b0-007a36a6a11f", "value": "Travel_Gamma_Archive_220.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94278d1-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057487, "uuid": "0bbf7feb-442d-4873-9445-6a03934f8400", "comment": "Malware payload (AgentTesla)", "value": "c1e8757f88d2b7b0449e6b965fcdb603", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057487, "uuid": "2ca12e32-53b7-4a5e-9954-ac3c3bc38d98", "comment": "Malware payload (AgentTesla)", "value": "0257aa401044360bbb8c9e775d094b9bd8024ac8a6bb3140a7257fff51ea49f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057487, "uuid": "4ee1a2a4-a306-4e91-8bfe-d874cd209870", "comment": "Malware payload (AgentTesla)", "value": "0808f5d8935871ba3ff80f83cefad49437ff83ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057487, "uuid": "9e8c99dd-7c3b-4d77-b952-3434f5b6159e", "comment": "Malware payload (AgentTesla)", "value": "dcffd5c3b69a021d979eb5e3cbc0755fa3fe991f3700507ee62a54b72569a541249fd6ae831c8fe5f88b37ce42808752", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057487, "uuid": "142b2bb7-9ee5-4de8-9855-b6fe6aac04d0", "value": "T18F6502118AC82FB9CFDC5A1C80FE161EA3E04A8F5016B98AEF37BD46AFF75445107199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057487, "uuid": "2953d7de-6fae-431e-9bbc-6bb3e902f16a", "value": "24576:R/6hxXWUYdcK6gbr2YWatxa2bd43qjHcoXqzMTfhN44:t6vXWUmvx2wrbgqZoypNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057487, "uuid": "298996de-cbd3-410c-bfda-7fa510adbae7", "value": 1467565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057487, "uuid": "38a34cdf-71c6-4e2f-a816-e1c988fb10e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057487, "uuid": "e3efce44-fede-4cd5-9776-1c880c73a8b5", "value": "Order PO-25-012379REV001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e1ce5-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040067, "uuid": "6d76f46f-21fe-4d54-95cd-dca6ae24204c", "comment": "Malware payload", "value": "33669b1646ea8b64c0a82b8b52140f14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040067, "uuid": "aa80e058-aece-429f-8e99-c64776a12034", "comment": "Malware payload", "value": "028f1e2ce50f9911d30905bdfb4b706fc520f32d7a753b83022de1812944b976", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040067, "uuid": "a0fdb658-7484-4573-b02d-2ce36b5b0d34", "comment": "Malware payload", "value": "e7f8b78ed1e35a83a1790114e1436684c08788f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040067, "uuid": "6ca3228e-5331-475c-b536-34d41a14952f", "comment": "Malware payload", "value": "d98c75aa8a4d4f4852e3c3cfd2b932f4eceb5cc25b3525d9c5493273d348993f383870d94306fce837e842f02ea95606", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040067, "uuid": "a68e07d8-76e7-41fc-80ca-fd8642db7d51", "value": "T102C633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040067, "uuid": "77020602-01fd-4d7b-83e3-0cd976004fe7", "value": "49152:S6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOcB:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040067, "uuid": "8d33999a-3fbe-4425-803e-00f08a98b202", "value": 12190323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040067, "uuid": "e4dbd456-dca2-4828-a802-86f7864a75c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040067, "uuid": "ff630e1f-e564-4aad-b482-a51838d2734d", "value": "028f1e2ce50f9911d30905bdfb4b706fc520f32d7a753b83022de1812944b976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002fd717-2d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775022763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "f955363e-51c3-4dc0-aeaf-9ea236905586", "comment": "Malware payload (Vidar)", "value": "5eea0e399cedd790bb99479235b8afa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "e9d55886-9713-43d5-8bc5-e711a7a1b901", "comment": "Malware payload (Vidar)", "value": "03d2a635141e85d29fcf435c457ed8037acac91181f3f1844e8cc6249de178f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "cba6e26c-e256-4c33-8d12-d9d3ccdd69ac", "comment": "Malware payload (Vidar)", "value": "bb7cc5310580d5b573996adcfb051d49687a57aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "88bee6e0-d3e0-4d57-82f8-500a1423cf6a", "comment": "Malware payload (Vidar)", "value": "5dfd159f9baae5e74d9ee55660b3e01984d81f663d74d10ba2c8d18ac436385513814c6dc07312e662c58fb023cb3c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "2b405917-f8fe-495b-9069-355bfa3b81f3", "value": "T189957C4B7CD148BAD06A933288F25295BB72F81A0B3223D32F50B6783F76BD05975764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "f657ad6b-2172-431c-8a99-781dfd77acdd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "e4967fc9-33f1-41bf-b8eb-27c30fd4ac49", "value": "24576:kCau/2Pato3yXpgAi23qNPVPucVw7dsIdDi4DfzuU+DvRtdoBnw+F1+13GRWdtNl:kCauuytThqNlXVw7pJVq/doV81H3wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022763, "uuid": "54518a73-dbb6-4383-afdf-4aebbf0909cb", "value": 1920640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022763, "uuid": "17ac2c57-1ae8-4379-be68-51100ee27b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "f3a2de12-39e0-4edb-ba83-cfbc8a67cd6b", "value": "03d2a635141e85d29fcf435c457ed8037acac91181f3f1844e8cc6249de178f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a489d33b-2dc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045372, "uuid": "bd20ff80-f04b-4f8f-a135-9e4ec66f26bf", "comment": "Malware payload", "value": "85e596bc08ac8e28887f0b40a4ec3064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045372, "uuid": "3e7ed859-1be5-4c53-9659-0a48b356be6a", "comment": "Malware payload", "value": "04f4dde250db15de247e67ecd25134ab7e4512a77859589f4e979905685316c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045372, "uuid": "f764870e-bc81-40a2-bbe4-af8e650f15f0", "comment": "Malware payload", "value": "9d3c257c150dc3581fcb7819e34566ee793405ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045372, "uuid": "4e53dc83-7a86-426b-b163-f3fbe9a99f18", "comment": "Malware payload", "value": "f29ee04a78b35b37ee1e2fce5facf374c842a52c71b69764b2d0e5ba35718dbb7a42c4b464e82d73e69c00c514eb0976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045372, "uuid": "f21a29dc-8b48-472a-9e36-c776dcfa6de3", "value": "T114037E48366C8763DE5F4E7CB4D5966B0EB2E322DD12EB899CDC90C98CA33911A0475F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045372, "uuid": "8c6b6bb8-d18c-4bc8-8702-b3a943e3b50b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045372, "uuid": "94b0b1aa-5e7e-43fa-83b3-2ae8fc0fbac3", "value": "768:QMsC0RYhDSnbIdiI/bwGOr0hNWSZaqVUvu9+0AmbLo:QMsvRYLiQb/k0OKaiU0+0Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045372, "uuid": "66851e4a-2cbd-4100-8599-a23f23461d1d", "value": 41216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045372, "uuid": "ec4032e3-294c-44db-abdf-40d3cf94487c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045372, "uuid": "906d7f91-f523-4a92-b4d1-87c2db6d77b0", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a136212-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053300, "uuid": "af754507-964d-4185-aee1-3ec1c32c2e77", "comment": "Malware payload (Mirai)", "value": "672fb64c30845400a85a77fe73562a0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053300, "uuid": "ddd9783c-7fd0-4425-8f86-b273acc496a7", "comment": "Malware payload (Mirai)", "value": "0516e1041091c8a7d30f1a19bdff7fc54449e634f3d15b7cb6ac40395075ddb9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053300, "uuid": "47bacda4-4c3d-4ca4-ba21-c7dce99cd34d", "comment": "Malware payload (Mirai)", "value": "c125aa0e44178b34055181b55415759812d785fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053300, "uuid": "8fa0d684-4ce0-4d0c-bdc3-4b5d21a49e64", "comment": "Malware payload (Mirai)", "value": "b2a27bd48f490d6ddd8a512839437a252a650e3b834d50d9a714f53f52fbf5caa7a29ce41c8b6661816c35be174ac18f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053300, "uuid": "307f7d01-bb2f-417b-b317-853305b08e23", "value": "T11F53941A2A258FADF76C873487B74E229799379727E1C644D15CEE001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053300, "uuid": "830cd7ae-69c5-4370-9b52-e446b7ba638c", "value": "1536:dMBsSfx/6HdeKImzB1M1a6Bc2ueZqf3J3J9:afyHdeKFB1ZeZEZZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053300, "uuid": "019cbb00-4286-455a-90b0-b2540025319d", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053300, "uuid": "2498dbf7-2291-4ed6-bab3-95027e42efb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053300, "uuid": "d2864085-57b2-44ae-8341-15d6d72895a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b95d99-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080895, "uuid": "18b2dee8-4daa-46c4-bda1-3990a19131c1", "comment": "Malware payload (Mirai)", "value": "8e84bcd997ecc38272780dcfcec5cadb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080895, "uuid": "6fa675ef-e0a5-4e99-99e8-949548640730", "comment": "Malware payload (Mirai)", "value": "055bb8e6aa03abeb77197cb16ce81da03b3df20e29d96997ce67f567624183c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080895, "uuid": "e892409f-6a86-4761-8e1e-e49051daed75", "comment": "Malware payload (Mirai)", "value": "050795b6a8916c6f44a2c22e69f76cf612c3f53f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080895, "uuid": "739f0061-301f-4432-af6c-5adbe18c4cf4", "comment": "Malware payload (Mirai)", "value": "c2db1981a5b9ecbe29d2d6e32870d40bbede1f57ae44fc6ad0dc4425900e616018f9eadf8a2a16b97bdfb4bc14c1d41d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080895, "uuid": "db091518-9a90-40e3-888b-fb89fb531fc0", "value": "T1BA343A2AED61D0A9D453D1B86BEAC0A2F730F8F40321755F33A96A752E78F504B19387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080895, "uuid": "9179978b-5844-44d9-8aa6-d37e6053aa49", "value": "3072:9jEYLJ1hVgDu6UbummpGi6mdm+myWmajm5mG8/1xKswLZFc3/FbkufEN2xIcnr/F:9jESt63U1TR/ezQ/FbFEc279E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080895, "uuid": "4c17911c-05a8-46c3-ae06-f8382d7e6b52", "value": 235088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080895, "uuid": "05f46f33-be39-44e5-b47f-a4cf61195eb2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080895, "uuid": "f610e94b-ed45-408f-b6b3-3c24c978259f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94640949-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775028595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028595, "uuid": "05ac15f8-1fd9-4d31-88ed-0e51117c526c", "comment": "Malware payload (a310Logger)", "value": "779122a03649306146f5c9f86ce8b98e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028595, "uuid": "128bd550-1a4d-4c88-9ac0-f007966461d4", "comment": "Malware payload (a310Logger)", "value": "056ead71752e1f25de69d9cf3e96988f2bb7f2635c0a2bdbdef334a7213e615f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028595, "uuid": "601d7926-2254-4b7f-8fbe-3907bacba4d0", "comment": "Malware payload (a310Logger)", "value": "674690de61b30d5daf4dc82172c498018d89ae96", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028595, "uuid": "d48edaf1-0b91-477a-b03e-6af9ded1e8f9", "comment": "Malware payload (a310Logger)", "value": "5c55d097a332a0a4b1e6311b4bd6ddbfd0f481c29c9ab1f24a863d524cddf8f4a36ff43eeb9c7d07bbd8cf5619b8f17d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028595, "uuid": "d6e3397a-6ba0-4588-afb0-ce5b4dacf8fe", "value": "T1F955CF027391C062FFAB92734F5AF6115BBC79260123A62F13981DB9BD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028595, "uuid": "a1de26dc-8942-4476-afa9-bbc5057664e7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028595, "uuid": "7f3cc997-575b-491f-a5a8-3f3240377b7a", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaT7WoaS0Y6xi6+LEid:0PVt/LZeJbInQRaT7WoaS6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028595, "uuid": "d8ad0562-cecf-4158-8486-945aff79851b", "value": 1317888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028595, "uuid": "c3e5d0ef-8002-45cc-a331-0d1ab88e3f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028595, "uuid": "5d9fe356-a976-4565-bfcf-ac24617da6b2", "value": "Halkbank Ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeb22e5-2e08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775075050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075050, "uuid": "5e36cce7-217b-49a2-b887-a08bf45b513e", "comment": "Malware payload", "value": "2784d93333fa8284267a70b25ed00706", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075050, "uuid": "4ea643a9-e445-4244-800a-ac124c5c6ead", "comment": "Malware payload", "value": "05995356583300d087cb73da34fc9722099c6229325cbe240bf6ba32aac258a5", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075050, "uuid": "baa41afa-a21e-4741-bc08-0af63e1dd05e", "comment": "Malware payload", "value": "3dcb019973629bcdb423ac6e0df1ef29c4fbd89f", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075050, "uuid": "c519a8bf-83a9-483f-a22c-543ced697c18", "comment": "Malware payload", "value": "f48ce1172e28c8aafcc2538a3379054ae082f3b9ab94b06657d6a60bfc1eb802db42dddc8b140cb0a0789c81446452aa", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075050, "uuid": "f5cca16c-128e-47c9-8294-fb422f6c5693", "value": "T1A8E49AAFEE2176C4E9916FFA96C06D0197B07C92758101ABE1B6B71BCE389434F9C344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075050, "uuid": "da365ec2-0e7b-419f-af2a-a35d539b3a85", "value": "6144:dCv+cIcryKQk+ZViQBQXhBL+JR+ld2VXXuR2SZpCzEDT6AanN/itx/cQV2vPz3:JcWHV5UhBs+lMVXXuR2KkzGT6dnbz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075050, "uuid": "e623867f-bd01-4722-9357-bfc732da8f98", "value": 658760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075050, "uuid": "2d24a182-f083-4f0b-a314-ecc723fb7cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075050, "uuid": "fdd4d8ea-8573-4759-b904-627ef14ab949", "value": "Feather.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4485a95c-2e13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775079571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079571, "uuid": "3b9db4fa-ad0c-422f-9cde-0194b3a76c90", "comment": "Malware payload", "value": "284b79501c8a02675e21e83b0f34bf3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079571, "uuid": "139b0f26-8abd-4c33-b3c2-24a93ef5ab84", "comment": "Malware payload", "value": "069ffbb33fbc48183be0d0d17bd420e6d4383f80200c546e9735b7a52750c5e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079571, "uuid": "d84a555f-794e-42c8-af96-4b6d53e7d8f3", "comment": "Malware payload", "value": "a6aad985ce9623ff9a715932166ffe4c5c4e9b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079571, "uuid": "149ab191-b8e8-4d08-9fc5-905b1477df7a", "comment": "Malware payload", "value": "2b2d1b032808c5f6cc80c4e3106c06641dbb73ab11f063f681da0389cfa8799040ec6c060726f96a430591aa72232345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079571, "uuid": "6fa7ce4b-3b0c-4957-b040-d875a5390833", "value": "T1AF63511E2A618FADFB6D873447B75E21F24863D212E2C640E15CE9015EA034E785FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079571, "uuid": "3a8150bf-717f-4ec1-8d3e-0eb6896e22c3", "value": "1536:qZSWtG1Oyu8jDZARvDMNYdDiwZwnUwbZnj:+G1OMlAeNYdDiwZoUwbZnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079571, "uuid": "256f0c99-c032-489a-b9e1-918f30c119e8", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079571, "uuid": "f0155d51-0c4d-4020-bf1b-74f6812bdb83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079571, "uuid": "daa99873-4001-4a0e-89ec-be836c9933ed", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97527a71-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775028600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028600, "uuid": "460da6f0-684b-450d-a7a0-51895bc2d4d5", "comment": "Malware payload (Formbook)", "value": "1e432590777252840f5fdc28811e2d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028600, "uuid": "9aaa1efa-b660-4fce-a793-f7d7a19acb92", "comment": "Malware payload (Formbook)", "value": "06b4ddac05fc7398b45ed27aa2964f548d57513d7143cad79f9b34c95489f55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028600, "uuid": "adedd5f7-a6a5-46bf-93ca-ecad8ea72951", "comment": "Malware payload (Formbook)", "value": "d7e32697178f3f001e83b71ff59aacf1ed0c53b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028600, "uuid": "ad8e41a1-403a-42f6-a211-334c0769661d", "comment": "Malware payload (Formbook)", "value": "4bf22f8e7aaba58decd31f0b05b0ce2eabf94a1b57a7b83e5528cd633b7c72e9a029ca934d08f39521cc7732c7268fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028600, "uuid": "046a6e15-8823-427d-8ffc-958ab1773a60", "value": "T17425F0543368DF02D4B65FF04871E27817F82E4D6411E31AAEFA6CEBB238B496954393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028600, "uuid": "54177cb0-1bb8-496c-8532-aea6c851e76f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028600, "uuid": "6d59111b-7d33-42f8-96cc-2d44954996ba", "value": "24576:PUjVxXpN4HB/n4Ig5HxDNacDJ9VnEMD3d:KVt4Z4/yYZnEEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028600, "uuid": "1608fe39-3449-4860-81df-99950992a10e", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028600, "uuid": "4fb8a37b-45f8-48a8-b50c-a4b58d33180a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028600, "uuid": "bd1345e5-82d6-4516-b250-e7ff82e11327", "value": "NEW ORDER.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cc6e2a-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064170, "uuid": "611f05ed-9ee9-44a3-b5f4-d88e6dbd3c7f", "comment": "Malware payload", "value": "9fa6dc9e17a4e844ccc5ea69ce27a47f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064170, "uuid": "8c370926-d5c0-4615-be0b-817be4361602", "comment": "Malware payload", "value": "0794add65a271388acc6ab87a0dc2fe47373b40921f22dec12c02f74fbe6b154", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064170, "uuid": "a52faeab-6e49-4fe0-a9db-22afec8147d0", "comment": "Malware payload", "value": "57e54cceb77a018b1ad63329da4ea8873d3bc528", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064170, "uuid": "e6b9eed7-b550-4b06-8afa-b1ac7e189a48", "comment": "Malware payload", "value": "2762bfc1a9fc1de4838860936dd45d7d3d1afbddf6de136edd21214803a0653fad034c85f951e65200b4a1f5c1681542", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064170, "uuid": "c40eb341-6479-4f92-87c8-4c3f612b463b", "value": "T1EE6335797A0748A447AE341CCCC02F12C992ED7CD0382DD8D4D6ABDDF9CE51E6961E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064170, "uuid": "19d0315b-ce3b-44dd-ad0a-bbe6e41a8189", "value": "1536:D0VTwgMnzn49Vith8zYVm3QT97TpWz2dD7FlECgy22Kfud4dDAV:D0VTwgMnzn49Vith8zYVm3QT97TpWz2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064170, "uuid": "c2b6477b-75f0-4ef8-8ccc-f494411cc8dc", "value": 67197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064170, "uuid": "1c6e30b2-ded9-4028-ab01-13a50ad184fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064170, "uuid": "ee709e40-3a3c-4524-bf34-0cb7c91b3ef7", "value": "2license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e24fc1-2e09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775075325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075325, "uuid": "eeac15a7-d340-4f74-9f37-1d992879ca45", "comment": "Malware payload", "value": "7ba80e92cdf2f7e7d7caeea6500c043b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075325, "uuid": "6786ded6-6783-4fc6-be8f-246a27b50dc1", "comment": "Malware payload", "value": "07ed16cf0a516f5c201b0651c6e6faaf855c02280db5c1dfb1c7ac4e8b660d29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075325, "uuid": "2273d1ec-22bb-40b2-929e-483becfb5975", "comment": "Malware payload", "value": "99ed0d832041b5586312f4b4ae8d5b5c22e2fd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075325, "uuid": "077d2c55-4d49-449b-878a-7f949e3c4024", "comment": "Malware payload", "value": "44c87648fb09b0c6763dc32dccc4b5eda675091d2ec8f03c4d13cfd15471330b606d8dd68a884c77884d008dcf7e2dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075325, "uuid": "5d862493-facb-4a58-83e7-61c0056317d0", "value": "T12294C40CFE91F805DE1A3D77CBE614044B7125C22E229682329A6FFD8B5537758E26BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075325, "uuid": "5becef83-74d2-496f-b2d2-45e8f4239fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075325, "uuid": "d72a48b9-ef9d-462a-b4bd-e4310769a32a", "value": "6144:xXSf3xRcVSdejsF30FH7Jqoee6VlWT8b991qppm066lbDp6iOXAGAH:l+B8jfLePVle84pjFo4GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075325, "uuid": "11136044-c36a-4605-ace9-6a3a0f2bc318", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075325, "uuid": "e7cd6a9d-6c6e-4a9f-9795-8a87a929a477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075325, "uuid": "5a3abd0e-c672-464a-8cda-9e01a839703f", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb91c60-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041363, "uuid": "685c4414-62e6-46ed-9873-fc7d7b398f72", "comment": "Malware payload (Vidar)", "value": "affd193bacbfb21329c924261b53001a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041363, "uuid": "75110f91-62f9-4101-9e3c-f9a150c80bd8", "comment": "Malware payload (Vidar)", "value": "0a7c791f3559b76c06008621fd91a562c151f4c0fd370ac6b473090d617f6c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041363, "uuid": "66364860-e87e-4c09-857d-e30647376d57", "comment": "Malware payload (Vidar)", "value": "ec297753863b54aff1e0aff905021bf3e5cf08b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041363, "uuid": "8e371d91-9f37-4780-8c95-30ad5d88faf3", "comment": "Malware payload (Vidar)", "value": "61414258e8a3c0bbf7da77cade27b50cf6f4596ce4f15bad4222f8f0fc6ed0a4be4a56bb5056623882cd0da79ebed8e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041363, "uuid": "bf77877d-b481-4d56-9896-1017d353bb1d", "value": "T103275BE2EE50072AD69BE33ADCA252492230B545133514D7BBA917958C6BFC4133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041363, "uuid": "241dcd7c-f118-4777-bca6-f86b73679eb6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041363, "uuid": "effedd16-042a-4699-9683-b12b4b255ec4", "value": "49152:x5JKt+xNAs6YbDcuHdUVOpxgsaYXdb1mNcYaNJeWz7QODXYJN64czLb/zUYZKRWN:xvZtA8haSKMI4eWmBjL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041363, "uuid": "3e1a6a11-810d-466e-8e10-7c012fa76fdb", "value": 21956736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041363, "uuid": "e73f5320-7175-4252-9b61-0b46e0672c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041363, "uuid": "b7bf3483-6117-4d99-ac66-eb16d1ecf746", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cc8994-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057675, "uuid": "15fe063c-dc46-4b10-9d50-200c7cbe8a75", "comment": "Malware payload", "value": "6d81f4caebdba637edd93b5d685678e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057675, "uuid": "bd6dc63a-6eca-483f-af2d-723075ecc3da", "comment": "Malware payload", "value": "0a9f86fe3269bbcffa5b33c21cd0a6d7216d3cbca09f242dab46f40e42f35e63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057675, "uuid": "52f0a866-329c-4fab-b33d-8d946e8586d1", "comment": "Malware payload", "value": "2321b5c2393494cb2f0054bfaa9cf0615fe59d6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057675, "uuid": "0d89c9d5-2488-4076-afb9-97842fc941b0", "comment": "Malware payload", "value": "5a5a4c46602dafb02d1dd788220137f446c7db375936d2ab3729bc32cb91cba945a887a78405469f14f8a38352675ed6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057675, "uuid": "dd9174b6-b493-4ac9-8d86-ce5f0d2d27c7", "value": "T14AE37D60DA25027A0F472B9CFCA44661CABDC319453744B0F5DE870D920A9ECF3BDA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057675, "uuid": "63aab41a-c64a-4325-ac80-e6c19d2463ad", "value": "3072:dNaIvr2rc5C0zvn9rxrOBt5+M2XWjiKiYkuq9Kia4cTgiS4b7:doIvr2rc5C07UMM2GjfkuqrxWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057675, "uuid": "d96e0c04-6e41-48cd-a0ca-4a74ebf9670f", "value": 145134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057675, "uuid": "8c5fb7d9-3137-4cb0-ab42-be4d8a0ed3bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057675, "uuid": "0a6a14e1-fbb7-455b-99bb-4d08b0353a28", "value": "07453098V-0010011481-0031000092-20260327.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64a62d3-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041537, "uuid": "9d413e3c-042e-4a88-8369-6845bb98bc6a", "comment": "Malware payload", "value": "8cf49650b7a000d09e8af77c314dfdad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041537, "uuid": "d68264a2-fcef-45bc-b436-c02dfe28d8fb", "comment": "Malware payload", "value": "0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041537, "uuid": "68a8c616-fc2a-4ca6-a2b3-850172e6b327", "comment": "Malware payload", "value": "53495d74e72a0e74a2e1fdfe69f39fd538abd9e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041537, "uuid": "5c23e904-6dd8-4f1c-9e79-2dfae90a58d2", "comment": "Malware payload", "value": "95e17ccf9709b4ed3154ab4267a624df902fe99a65d6e50f9f4df60e7ea5cc11e9c1f2473bad0e4886ed5e7d6ffb9e66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041537, "uuid": "f5d6bb43-7efa-4633-ab30-421da732c399", "value": "T1AA61626A17B6522145B36A9B6E8FA4256C0BD2833609F9D07F9C89C45FCE50443738FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041537, "uuid": "cb25a024-f745-4fe7-82e0-3963b7dfc07f", "value": "48:eUc0cUi9W7M7aLj7EzjO3vlDXuKEAlbBlJ8LU37ElB3ywgWjP:Hc4gaLj76q39DX59fJ8pCWjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041537, "uuid": "0e2b0fee-1505-4ace-adfe-c67d29ea9976", "value": 3177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041537, "uuid": "9e75b0e2-4795-4f1d-9b74-7b38be561135", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041537, "uuid": "90a69e7f-2739-4f32-90c5-72b99befef2c", "value": "0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5075a1-2e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775080336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080336, "uuid": "6b805dde-2a10-4785-a5b1-bda166993e2d", "comment": "Malware payload", "value": "47e4ac5246b57d0b4c792a16224ef1ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080336, "uuid": "bff91edb-abd8-4b7f-a675-55b334bf84bd", "comment": "Malware payload", "value": "0c12a02d00900e8429083881f181548420dfe2dc9041c477b636cddcfb3eaa71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080336, "uuid": "e04990fa-b523-42df-bb45-2169b3afc1be", "comment": "Malware payload", "value": "e1753b6d4e21c38e1618bf2928cf0cd01af120a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080336, "uuid": "e3df5319-87a5-4ff0-98c9-207ef0a31266", "comment": "Malware payload", "value": "e89530056260fb85279e20e4262df20b8a889c30e98cd8165af1b26c5fdf3259bd67f4cf09c02128d20bab1a123679b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080336, "uuid": "a5451800-6fc0-4844-a737-54de49171194", "value": "T1C3B5BF16E3C826A9D517DA38C715E332C2B279664B62E1CF0A9AD7061F73E914B3F701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080336, "uuid": "37307b11-250c-4091-b7d7-4e2f39b1ebd3", "value": "f3d2e3bd314d6330a4de8e9c906db979", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080336, "uuid": "5598153e-df04-4ff5-bac1-d1866fb59cc4", "value": "49152:JFzx0tMLucGMAD2oKUOPZU6Ve3DdmaXKbdsxsiAQup1ZMJy:2WUhdmaXKbdsxsiAQup1ZMJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080336, "uuid": "16efcce3-fb73-45b5-a352-730f78fedbd7", "value": 2286592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080336, "uuid": "f9532fbe-2cf2-4879-b265-5a39037204b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080336, "uuid": "1dba4bb3-a1a8-4fd6-b15a-c72e7be4d6ab", "value": "krita.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317cffdb-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057635, "uuid": "49de509f-4429-4b05-957f-2e4c001405a0", "comment": "Malware payload (AgentTesla)", "value": "ad7108a5a8ae2ea772608b1fabd659d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057635, "uuid": "d8300f61-48a4-42d3-b731-72ff1b239e00", "comment": "Malware payload (AgentTesla)", "value": "0c43b3cf9251ecef561bec636c2e5f9ac1d7d5e724ff55f2033e9ac3415191df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057635, "uuid": "4af7d96f-f01e-4159-963d-3ae99f36d149", "comment": "Malware payload (AgentTesla)", "value": "a901b8c095cf84d16907912acd3aa3284de9d021", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057635, "uuid": "9d917706-0e6e-430e-ad7b-c9678f005352", "comment": "Malware payload (AgentTesla)", "value": "73eccadc496fe98f70aaa755634f6ddc0365f3391cac4f58162820719973c0a9cf08a9d70332013d5d7b547a18fa3476", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057635, "uuid": "0c36069b-b23f-4743-81e2-9c714a44e061", "value": "T1FE645D60ED3413578D9727ADACA85961C9FEC919922B40F5F7C9030E62016FCD7BE22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057635, "uuid": "95508e3b-47e0-4a7f-ad01-8ab00dcadbc2", "value": "6144:2DrwpWgQcdgTtO4ZoJKmH21i377/wsOP/DY0:2DrwpWgQcdgTtO4ZoJKmH21i377/wsO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057635, "uuid": "3e69dc32-c2b4-44be-88b2-bc8bbee1f386", "value": 316736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057635, "uuid": "60cf2da5-e363-433d-b906-7be1ee3702f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057635, "uuid": "c74a8ef9-b06a-49f0-8a52-363f6373cbfc", "value": "RENDEL\u00c9S 012026-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f58fa3-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "bfa25deb-3174-4d00-9c63-9a51ab917505", "comment": "Malware payload (Mirai)", "value": "6dce53abe0a849e17be39e4503d991eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "5360205f-72d7-4df4-99ef-2547da50a708", "comment": "Malware payload (Mirai)", "value": "0c57d23d936183c57b246b84ac572d7c9bc6f418841af2f26205244cfa5a6669", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "55529ad5-0bbc-483a-9cd8-d2ee8871ec37", "comment": "Malware payload (Mirai)", "value": "9612cc40066ea50e75c35fbad74bd547adfdb3da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "1881f5e2-7bf8-47be-a7ce-9d5615c43a54", "comment": "Malware payload (Mirai)", "value": "266d10cb78b9b29dc577225a514aafeec2382a13a4bcf72d7cf36761f01bff6a27053ccc438cb6379ac6b47985328b9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "79168ae5-7f9e-4b6e-9bc7-9fdcf44704d2", "value": "T174B3E085B210AA55C02672FCB1870A9093B17E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "eb05c330-fbdb-4ea9-b395-2c5e30f397c5", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuA:as5zqhr5Nzy7wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053590, "uuid": "cea9af30-b0c3-41a6-8986-f380f479408c", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053590, "uuid": "69a1a7d3-eb51-4727-a0ca-8e2da74354a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "4a0f6606-b2ee-43c2-8db6-f509bd2f05d6", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b630a21f-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775053992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053992, "uuid": "2cb18a8e-539c-4fbc-b5d4-bae3c8619bf0", "comment": "Malware payload (njrat)", "value": "afdcd7a00cc6a238fca95693981d3196", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053992, "uuid": "74047e53-3ed6-477c-81a5-900cb96919e2", "comment": "Malware payload (njrat)", "value": "0cc2afb8a1fa09db1502441113d5e3d1eac1c7fce2270bd27a7fd55c78bcd6ce", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053992, "uuid": "6cc9716c-ded9-4914-8ff7-34d5562936ca", "comment": "Malware payload (njrat)", "value": "c6b1dc367c2c31a05a80fcc2b11bf14e70034e68", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053992, "uuid": "dec4b3c9-ccf5-438c-ada3-b85b77079162", "comment": "Malware payload (njrat)", "value": "59abd0691ca5a6db627c9ec8ee561f97de63c3a5a0ee3d927d984b37cad4e812c12b21fe66b400028a7a0ce1d5d93825", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053992, "uuid": "cb122ec8-5d6a-43f9-9872-a384cab49890", "value": "T17045335B171087A8D9470F30929AD2AB793D6D1B751A42C4A5DEBBC409F3B4183AF0FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053992, "uuid": "a8ee9cab-404f-43be-84d7-793763907927", "value": "24576:ZYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnk93//:+QSadD+RwsLdaCPNj96gGKbBm1mn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053992, "uuid": "52f24ae8-0c1d-4a2d-ab58-ce7c3c7f3953", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053992, "uuid": "d5dc17b8-371e-47ca-93a4-c31af9199b84", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053992, "uuid": "0fdca292-4ceb-4ddc-81ca-9a64dfd42433", "value": "SetupMT_V5_717.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50096d9b-2db1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037500, "uuid": "bc87afee-8269-499e-a440-10a0005c046b", "comment": "Malware payload (Mirai)", "value": "4c54431490ba1199ccc6a96c22921ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037500, "uuid": "1a354801-73d3-4ef2-b5dd-8cff1906904f", "comment": "Malware payload (Mirai)", "value": "0d75e23d1f4f5cea76b18bb6f191f354f544b78157ed58a490e04af7d7e2c3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037500, "uuid": "2639f971-6a47-4329-ad7b-9ca7f165b36c", "comment": "Malware payload (Mirai)", "value": "8eabea972a97ed76fabe60b226ef446ade6e223a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037500, "uuid": "9fce53ef-0ccf-4bfb-b283-43ef881a31af", "comment": "Malware payload (Mirai)", "value": "428bfb46df467ce6c5fb90a4a833d817cc89e531edabec23efc39387eb365afa784fa7096537f26c0a2f46092febf88d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037500, "uuid": "d8a75c0f-a50e-46bc-b307-ab7af8309763", "value": "T1F6044A85FCD19A12CAC622BFFB1E528D372653A8D2EE31039D265F21338759B0E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037500, "uuid": "b257c952-1825-4f5c-8398-760f50e8b8e2", "value": "3072:2+LLSG9fhVfxDIs10UugxkfI5zf4eRC/ExZ/1ltMT2P:2+LLSIfhVf1pegxkwlf4e4/yR1ltM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037500, "uuid": "aabf7fa6-4f40-48ab-8a2a-c797fa251eff", "value": 185888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037500, "uuid": "03c03c3f-f834-4fcf-ae63-5acd06f8897a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037500, "uuid": "b661c404-f816-4ad6-8164-7803c5728c83", "value": "kurayami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777b77ba-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775057752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057752, "uuid": "b4adb35f-d2df-4d44-b7ab-00bd1f7cc04b", "comment": "Malware payload (PhantomStealer)", "value": "114659e7715685aa897e910400c025a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057752, "uuid": "4acf0ae9-ff95-4240-9975-32f3eeb81b46", "comment": "Malware payload (PhantomStealer)", "value": "0e3c53da60b8a0181451c42dfc3d9bb0cee56b6a98028729416da61c1aa785c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057752, "uuid": "c0f8061c-3a2d-412c-a5a8-c74d0a8b761f", "comment": "Malware payload (PhantomStealer)", "value": "24d0d3ccb3e3d161e4f91840bb77456e2f625406", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057752, "uuid": "0197ae81-8908-431a-9c1c-2193d31ab34e", "comment": "Malware payload (PhantomStealer)", "value": "b2887bd644d8145a91ec330c5cc050ea71a31d3c6d2ed7adbce0a8b37db5e5014e659886c1f3c0c15f1e6e73eb42726e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057752, "uuid": "a6761cb6-0db7-45f9-8827-893017140984", "value": "T1BC54E102E7E08010B2B25F5598FD58931EBB79330E2E49CE05626F5D89F5E96CCB1E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057752, "uuid": "3d473ba4-060f-4b3d-a522-0a7779f2dcc7", "value": "6144:4vWkHYRCDb08jRtF1nJIXO/HhsjZen1RtqHTdSwTCcWKxR9:2pAI1JI0ScRgOcJH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057752, "uuid": "33b9f782-3967-4908-a88b-b891c852807f", "value": 303494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057752, "uuid": "ee20d896-d085-4d34-b9f4-4b5719d4a81f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057752, "uuid": "d6106bf2-a3fa-4f39-92b6-8439cea3ffbc", "value": "Purchase_Order#0037676389.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebd4b60-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "742888be-d060-4caf-a41f-b7ee93084053", "comment": "Malware payload (Mirai)", "value": "eefa0ffb201f49bec627b70117f57a7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "ee48f75e-cfe5-487e-bc8e-2db201351218", "comment": "Malware payload (Mirai)", "value": "0e8014c37974401c21e48e03396e2587a3107de2cf1822eaec043cdbb00d42ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "53ecad9b-e408-475c-8d4d-a3bb09aed905", "comment": "Malware payload (Mirai)", "value": "b834681909886486706a356c724ace4f3e963a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "14301203-bdf0-4165-966e-f444ba2f32ab", "comment": "Malware payload (Mirai)", "value": "74b7a1f9424ffbb7582709c4496708ddcd03c26ab5d34e32649252a7f477eaa968249b4d9a155c7dc03ec50c43786880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "842e8c97-a831-467f-af35-df44918dd5e1", "value": "T16A13D806BB110FF7E88ACC37459E6705189E648862D4BF37BA38D8A4B64735E18F3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "367f8bbc-5d94-47c3-8fdd-c3559f7f42ce", "value": "384:UO+/DFQNLv7UsB5ffNd30o88l3DiE+u0l3DYZLxO9cZ/hySF7godFGPFBnmvoPVr:UO+/aNLvD02/L7giMhOz47JvvWaw7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080769, "uuid": "382aded9-7a9c-4e63-b396-3fca470545db", "value": 45112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080769, "uuid": "79189373-9675-44ef-9430-626d4b8e8996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "22240c39-be39-4d04-8229-5a5f35d93bed", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd488639-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057493, "uuid": "c53e6e34-0339-4738-9bf6-fdd7690f1ceb", "comment": "Malware payload", "value": "6acf5eeb7e8732e0a1188cf431b3d098", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057493, "uuid": "0e6681fc-9fd7-44c0-8427-3deb60809b53", "comment": "Malware payload", "value": "0ed5d0929110c2aa33a6978d97b45060dce4d565bc9efc5ddd21908bf46084de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057493, "uuid": "ed15d1cf-5d46-4939-bd99-af6cc8c2a58c", "comment": "Malware payload", "value": "4d17fc75201b3323644cf2ae62ad6f7261087390", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057493, "uuid": "3c6fe6c5-8a78-4e5d-8703-e537c78c226f", "comment": "Malware payload", "value": "8a52634cded8c8daf1c4714956b9b8d7ee52f2af3365d771326ec24f4bb372686c592bbecc0cd97f7034e6ecb55989f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057493, "uuid": "599298e0-ca31-4955-84ee-cb7a51805652", "value": "T15CD208E48E973FB489F3A60458CAD1B1CBA91201743A8313F54ED3682B41568DA75EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057493, "uuid": "5ef79fde-3589-4170-8916-187e842190f1", "value": "768:fUiSOt4R2pYbwpKDnjCptFRT9ZPawrWstoNsp/2Kq5RxwZ:fUKtCyEwpKDnjCptFRT9ZPawVtoNo2KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057493, "uuid": "1ccc43b5-bb0b-4f93-b628-4091b1474a9d", "value": 28690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057493, "uuid": "159fa296-57fc-4d7d-9805-0c599143d040", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057493, "uuid": "9ba6011f-be4f-4a89-b5e8-9361b6db6064", "value": "9.027 liwg SWIFT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d1c1a4-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041620, "uuid": "6b7bb04b-5fa7-4cab-8467-d34c0a133fc3", "comment": "Malware payload", "value": "62446320089113b10b86c0e78c71507a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041620, "uuid": "0138c999-48b5-40d8-8bc6-383b669daece", "comment": "Malware payload", "value": "105bc76ac37570568aac5d1a4007fd24ed2c3176bb25866b2658c4a59fc882fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041620, "uuid": "2d1c5c2e-3371-4de1-89b8-5ebbf1fe0fdf", "comment": "Malware payload", "value": "b8e01b0f938529ad6bfe3ffabd55c96a883470ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041620, "uuid": "9005e562-03d9-4c26-b4f9-529df180c3ee", "comment": "Malware payload", "value": "0fefbef01fad4cc72e9c57f3f3a032696bf69ca6a829a07461721fe76b1d1c106d8edb49514ff6cfee4d0ea6ec637bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041620, "uuid": "ee21619d-f8bd-4717-adfd-1f957e7f6304", "value": "T1644633A37FE4A2D3ED144A33093E47F15435BF265F9852472778B43A9833BA0AE4588D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041620, "uuid": "788ca7b9-d535-4e6f-9116-3d574c922da7", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041620, "uuid": "ea41444e-eced-4b51-998c-629c3b1f72b9", "value": "98304:twM+mGwIAwILn0fPb2jGuP1yQ53yAl9D0uhzh/Vdu6Oy6y2DNdXdATK:W3awILn0CauP173yAPD9zdxOyMdX+TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041620, "uuid": "81d32119-d609-49d2-878b-374b3455ac12", "value": 5733888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041620, "uuid": "42dd4a1c-201a-448e-bb4d-5fa246ea2d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041620, "uuid": "f7141099-de13-4104-849e-7d7be4756926", "value": "PowerISO9-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9f179c-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775050593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050593, "uuid": "54ca8182-eb4e-4e96-b50b-710e4e368163", "comment": "Malware payload (ConnectWise)", "value": "13281e1cab38af502aaff02dae3bbaf2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050593, "uuid": "44e4133b-ee5c-439a-9151-259b2f72da76", "comment": "Malware payload (ConnectWise)", "value": "107258e7aa0b8550362bf1f6645c12fa6721da5a3bd6e5128ec6928bef9ab8e6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050593, "uuid": "4185e352-4893-495f-aea6-8cc4e13b1b0d", "comment": "Malware payload (ConnectWise)", "value": "5e6efe92f40d3d7094141e7246f91c973e782127", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050593, "uuid": "f221760e-0320-4876-8617-8f608563cadd", "comment": "Malware payload (ConnectWise)", "value": "bcbe5d2a551328a5045a12cdacda29e3f05f5c0aa01ece2682925c1a661fb5a8614d125856c020414d2e9f24f4a65234", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050593, "uuid": "3a06ffb4-1ddb-46e7-a8e4-5f115fcd4f4e", "value": "T161A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050593, "uuid": "9b9cb3bf-da07-43e1-bc5b-52ba681058f4", "value": "196608:MnCtVYqI5MvbWEpKkqVIJqKWnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:ICXvI5MvHxpJwCXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050593, "uuid": "66d7170d-13cb-4275-9d17-0341448fe6f3", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050593, "uuid": "f1a75e4b-15e5-416c-8dd9-5ca4e6a4bde8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050593, "uuid": "a83b3bdd-47b4-45d9-ab96-887fd171fa73", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3a58e1-2dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775044716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044716, "uuid": "dc6ae42a-9055-42b8-9b50-6931590a0dab", "comment": "Malware payload (ACRStealer)", "value": "b6a477d02d93577dd8a35c144d1ec436", "object_relation": "md5", "Tag": [ { "name": "193-233-113-146", "colour": "#9E86DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044716, "uuid": "a7a161e2-b886-40ab-a2a4-9fe692079e9c", "comment": "Malware payload (ACRStealer)", "value": "11acea5515c1b6124820eff92e45e6187c2393ba34a05c3ad4b82e58e64e815d", "object_relation": "sha256", "Tag": [ { "name": "193-233-113-146", "colour": "#9E86DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044716, "uuid": "ea9692fc-be14-4e42-b61d-df4735bb20ee", "comment": "Malware payload (ACRStealer)", "value": "9c7f32a78322486453cda841449a15134d448e59", "object_relation": "sha1", "Tag": [ { "name": "193-233-113-146", "colour": "#9E86DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044716, "uuid": "367c7aab-0a4c-4efc-9938-4bbc2c530650", "comment": "Malware payload (ACRStealer)", "value": "9fdeddbede8df4f7bfa1336a37260ce4252bce375d41f1254572b392f51df1bdcc5d618e1fa1278c8075927dd0af0b89", "object_relation": "sha3-384", "Tag": [ { "name": "193-233-113-146", "colour": "#9E86DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044716, "uuid": "7ec3d0eb-5316-482b-a79d-2312c66fdaf4", "value": "T151867D1076914021E9B20579CE79AAFE852CBE240F3494DF57E87A2F4EB15C31A37B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044716, "uuid": "435f4f21-a730-4f4d-926a-f1c72f562d0a", "value": "8f1c919525a80c12b439d7d6ce631349", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044716, "uuid": "d9c6ce86-4293-4028-bf0b-38030978bb78", "value": "98304:cSwFz+AYiNtjT7U9IzXwIxMqN9qecKs+FOWiUMXPtCjwewHbaYnVJ:cWAXbjPzXiuRXivkYaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775044716, "uuid": "5e7cd129-dbe0-4e38-a9f8-dd328143af81", "value": 8559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775044716, "uuid": "42b741e4-d96f-4d84-a44e-3a9e4ea18d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044716, "uuid": "76b3440f-bef0-49b7-9c32-f3ee8450e54a", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382ea528-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload (SSHdKit)", "timestamp": 1775079980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079980, "uuid": "46a94547-d2e3-4a59-a530-d7049a63e8cf", "comment": "Malware payload (SSHdKit)", "value": "5041fd2cdeaf07665cf64cccdf316347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079980, "uuid": "b61bceb4-fb1e-48da-a449-aabd1936b8ea", "comment": "Malware payload (SSHdKit)", "value": "1220e297a10a6ba04dac02c373195fd2855252fc2966beb5f84d280737be5616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079980, "uuid": "da31b5d0-0ff6-46e9-8e78-54c81992ce97", "comment": "Malware payload (SSHdKit)", "value": "ebb9b8af9f3692e5d7836d16c051b1c1e075f7cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079980, "uuid": "c441857c-96f4-4158-95ae-bb9c6479ec51", "comment": "Malware payload (SSHdKit)", "value": "22ffb9d1ec545b8dc05c2c2305f3e62c8cd81f648255847e1edf6fef56879b1285867f3a179b5a4098ecbefa36ccf610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079980, "uuid": "564d9053-5cc7-4aa8-a7c7-ef455a21cfe3", "value": "T14B356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079980, "uuid": "26b46eef-9124-4e68-868e-809f987c340a", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6jTxIVD7bLv:E8dbbsO38+TfgRipIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079980, "uuid": "84e0f60b-0181-48ae-b401-16bf56831dfb", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079980, "uuid": "889d23ec-0205-4958-9f3f-304703ff4bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079980, "uuid": "a7e4225e-2464-48aa-8a8d-16ef303daca5", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3f402f-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028613, "uuid": "3ba798c5-963a-4a60-8f8b-c36d454ffba9", "comment": "Malware payload", "value": "7cb9fc5502ccc5e26749998524f354e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028613, "uuid": "1d963f66-2f35-460c-a341-177c14b8f7fd", "comment": "Malware payload", "value": "12862325902b7cea4aa28d15582fb2c62b57de3a53760f9abed655b089a4d76a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028613, "uuid": "56fb7f2b-5437-4861-9e8f-3b64b9d8ee05", "comment": "Malware payload", "value": "ca45ed630842e1c49dc3b19a387e657c7ed30a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028613, "uuid": "f24eeeaa-21d0-4e7d-8c14-5662a283a065", "comment": "Malware payload", "value": "f4d1ab6f829f897bfcd5428c3fac8b5b7fec1353fc9387ceeea9f879675a3f124bd2aca1f2363b30612878efdc6b08c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028613, "uuid": "fe18b859-2431-4e14-8d63-9b459702541e", "value": "T1ED567C5677F840F5C0BAC239C9828A4BE6F279410B31D7CF41914AA91F377E24D2AB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028613, "uuid": "b6d6fabf-f7c2-43ff-b579-59fcaf7567ca", "value": "838dd9fbdbb409224ad0e13122a109ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028613, "uuid": "b60e1a45-8102-4ebb-8a31-c62446922ff5", "value": "98304:d0FH0F83X3L3D7jcnq+6FDl+zeFJ1Mtxm:d+0F83roqd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028613, "uuid": "7caf89aa-6b5c-48fd-a6e3-b4bf2f1e4329", "value": 6128401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028613, "uuid": "bf292d2e-89fe-42c5-8d82-bd66023ef2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028613, "uuid": "0ee2d62a-e58e-4b73-bd4a-86af6290a32b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fdf3b5-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022724, "uuid": "a837f43b-6482-429d-9fb7-d55898774ad9", "comment": "Malware payload", "value": "8ebadaa39c78a63ff8ddd5e7f0a508ef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022724, "uuid": "f24563a7-b14a-43d5-bd85-4da11cf81405", "comment": "Malware payload", "value": "129ec52f4695bb8591b04d77eaf130f51e4128bd6788c42b2f089f4c9d2b5725", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022724, "uuid": "6631756c-b309-4bf3-bbe3-b8cb835a71c7", "comment": "Malware payload", "value": "b430eb42750316d09e79a03be2f2aff1d793a4e7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022724, "uuid": "0b48b1cd-16fd-428a-86ae-747fe281aea1", "comment": "Malware payload", "value": "ae23b15a83b9a92375dcbfd14d724504c559c564544c160dda7e07e7193dcb7f43dced88fed32f6cc0093c216ec40468", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022724, "uuid": "14088c97-50f2-442c-a21e-8cadb875d87b", "value": "T12072DD0F6278F75E2834F25C27607185EE08D48A8E5CE385B88BC1F0BB6D275B8E6557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022724, "uuid": "85d41905-aaec-455b-9b28-fd02b421c1ab", "value": "384:s0BZoq19MMwM9SSdB9z2tRf+yuP99gVeYn/nym:HkTIBZ2bfQKym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022724, "uuid": "23ce268b-bdf0-4651-91fe-39ef03f26ce4", "value": 17378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022724, "uuid": "8772b8be-d689-415a-9302-27d9ef66970b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022724, "uuid": "878f3d1f-57d2-4c46-9509-4680f9a4d489", "value": "0946_INTIMAC_PROC_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a465cba4-2df4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775066417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066417, "uuid": "f29fc272-cdb6-4a71-a928-f87239e87879", "comment": "Malware payload (Formbook)", "value": "dba0190c3ff660413ab28f5d28cd695e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066417, "uuid": "5abda40c-77fe-4721-8240-da8281f79bdd", "comment": "Malware payload (Formbook)", "value": "132477f7a2dd9976fb8a9d3a0518ff2a545b76449b313dbc79b4f44b2f6147c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066417, "uuid": "0a50eaa0-cd26-4a83-8354-b20b288d0b3b", "comment": "Malware payload (Formbook)", "value": "c68d0e202ec56b17ed3960c4e2013825d4ab8bb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066417, "uuid": "0360faa0-59ba-4335-83f8-62cdb2aacefb", "comment": "Malware payload (Formbook)", "value": "445e30f3e148cdb4defdfedef13f88dde2d136dd5b3b27e8bc997c303e0dfc924c3398a6b37c2cdaf63b5e339eba471b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066417, "uuid": "f3aa0b36-c135-4473-a3dd-a66fd7f0934a", "value": "T171647C0225F3615577FF86908BE9B47F492EF9271B8CB07924884F0E4FA17448D9A7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066417, "uuid": "1d6e5de9-5537-4f57-a08d-388e800e9f51", "value": "6144:Q1isOcUO7GjkoNlkJJLGLXiOq3gFrKyBDflMMUrMLYoWP1lTo3z3x:QYJu7Gjk0lk3LcxqwVhFfWM0oWP1lTod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066417, "uuid": "6f31b10c-1d3f-4ac5-90c2-152b0a247615", "value": 332136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066417, "uuid": "4b4e9302-6062-4291-bdab-8de4948fa599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066417, "uuid": "36c1615d-8fc3-4277-b201-a4d839a972b1", "value": "rORDERO_17126.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6115424a-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057285, "uuid": "d36062e3-f482-4a98-80aa-77f67b382dd1", "comment": "Malware payload", "value": "cd638c2ded85a4a7d1e99280d2c22822", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057285, "uuid": "f947e493-2805-42de-991c-b7ec3d704f15", "comment": "Malware payload", "value": "143f5f5b77dcc2a43c9989840c854ac4240f0358f5a100104c3fba76a5afaf59", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057285, "uuid": "8422310e-6763-4fac-be52-307bce067135", "comment": "Malware payload", "value": "7ae0e39a57dc8441bc5ba566b0a6b8d3b907fc94", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057285, "uuid": "fa6bd0e5-3b14-4120-aa73-46e40821b100", "comment": "Malware payload", "value": "224df24bf4c69e1af2dc64053d6c07a6c9c36bd36d9cd3173a7f533920f083d4a3126d113d81e79c1f7e3ebdec8cd231", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057285, "uuid": "41925529-622b-4cca-8884-d3357aba8079", "value": "T13574390293FE9618F5F74F98AA7A50A14E77BE6A1C39D06C129C240D4AB3914C8F57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057285, "uuid": "08656b51-416c-4ae5-a1c3-8b79cb9b8661", "value": "6144:2AY+eSMRP/lPf1kJEI4R3+GXfygSql47wVhH4058j9wmvz0M8/0Sxplb+zHfq7DP:2AY+efR1H1kJEI4ROGvQk8wDmZwmv587", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057285, "uuid": "4832c75f-648a-441e-8145-b417957a689f", "value": 352782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057285, "uuid": "a59ee86b-dfbf-48b7-a035-e8a73da5b3c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057285, "uuid": "fc0912e1-9217-4710-8074-d8bdb2ad472d", "value": "fedex_tax_bill_document_receipt_payment_31_03_2026_000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229dc020-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053315, "uuid": "4aea0b53-2530-46eb-a4be-7b9f2e453f48", "comment": "Malware payload (Mirai)", "value": "247e18be4d0665e931cb9c6207e03c6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053315, "uuid": "91e4386a-7848-40d1-937e-6f6166a1f41a", "comment": "Malware payload (Mirai)", "value": "14405f522d9fe4a37433c8f6cc446bf48c3f83a44f11e523f6dcb5e562f17cf2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053315, "uuid": "4fc214ed-42d4-44d1-9cf4-d8205b049315", "comment": "Malware payload (Mirai)", "value": "dc58b986e7268e23d044bf2aac6eed140d4c0fd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053315, "uuid": "7118ee1c-16a4-40d4-8d56-ef7026855272", "comment": "Malware payload (Mirai)", "value": "9a0f4adff4807153a0966d91021f5c3e55354ef9ee2739fdd6e721d3c1438a1a129b01e6447d6885166635211e601db3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053315, "uuid": "f8d51ed0-3767-41d7-b369-748efc0864c2", "value": "T1DD3319B51516F2BCE9E22078F40720F529530A1C3ADCE2D3B0930579FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053315, "uuid": "bbce63b0-09e0-44ea-9e59-46bbe3171209", "value": "768:zMClhMqB0yBuKw3GoACzQyZRtlkABYxQCTUnRGww31:zF0vZ2oR9DtlksYiNrs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053315, "uuid": "3112dcb1-3ca5-4447-a530-a7b93bc42648", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053315, "uuid": "e9d4a2d6-2e7c-4127-b61a-37fcee0fe61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053315, "uuid": "88f3b187-0028-41d3-8c1e-5b03bd7538ca", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38acc89-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "7806b030-533b-4abf-924e-3f31ee329150", "comment": "Malware payload", "value": "958c8f4f9145a7d67692db172f73c650", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "84e859f9-3a82-4b8b-b778-d0723a77be53", "comment": "Malware payload", "value": "158091ec92a3a91d7d2d29e6b867d47479d624bcae5f067cc80af4eff91c9729", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "eb1a0293-7a03-4d42-a4fe-6e81a4fd59ae", "comment": "Malware payload", "value": "aaf49b7f38723095525c47cb221ff1576591aa74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "acecd272-4235-41c0-ada4-8be85dab8d40", "comment": "Malware payload", "value": "17029cd18fc9ab254e5d8016a7b4f750f877c811b0924faff7e46399c4fe3e56a8acc5b45b26ab078fb0b69f754ac18a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "e6d8d1f4-9f41-4682-8010-dbcae22fe4d8", "value": "T1FC617786077F2630D4A5579A8D1FD066B22BC1073345D9A0B5DCE6C86F8A560B2B3AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "8fab5432-ed10-4049-9549-937b61cfce20", "value": "96:VkACd/PyTlpmUsF68Sq4LDB4ojEscdRa+RtkRi5L25Vx/i:y/d/PvU8oXcdRaSoeKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041639, "uuid": "6ee81ff5-d13f-405c-865d-c6d0230c43fc", "value": 3228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041639, "uuid": "95eedac1-735a-4e8f-a734-0107adc889d2", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "c80877a0-52c6-4755-8340-b633c8bab705", "value": "deploy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3cf344-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775042028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042028, "uuid": "ac5213b5-8d78-41dc-ac21-241a1a86cd16", "comment": "Malware payload", "value": "655d52b15f7098968d650b0de8a6eaae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042028, "uuid": "a3fb124f-b3b8-41c6-8e4b-67a76e767880", "comment": "Malware payload", "value": "15a7b39481995b42e22456bdd8fbca01f4cce57859129cbc1e4631a3afbaa46a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042028, "uuid": "707fd068-512e-4f77-b55b-355ff658380c", "comment": "Malware payload", "value": "94df487cd374910a2117e746be4c502f04db6d26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042028, "uuid": "f7776253-2129-4363-a2cf-fe4f9a95a5de", "comment": "Malware payload", "value": "253810458271b91dbf35a5653c48a9eb67c3abeec87d126c8e119c9066460e7c0ebf8c0986f2e3a99d09c9b454a5ace5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042028, "uuid": "3b80c73a-652e-4d1d-8035-40c568254082", "value": "T11A7423A07AB51E31683C797F607BBB2F97667BACC9E6625DC7B138D04017644EC12830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042028, "uuid": "61f7305b-1d33-4e44-b0b8-0fc364e0127b", "value": "6144:4dhPt59+ON96Ml3ye69Zob9uYDCw6min6QxptRCrCh6hMOMlGcHwPcbrUyKcjxrn:a9+OqMxyv/o8YWhmOTtRAsSM6orXHZEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775042028, "uuid": "252b9431-5885-47fc-94d1-6748b1a23008", "value": 366009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775042028, "uuid": "a98adf27-188c-4b4d-892f-33495080b5f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042028, "uuid": "5c0c7203-e554-4e82-acae-0a46599f0ba2", "value": "chrome_100_percent.pak.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b98e488-2db0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037143, "uuid": "9068e959-9343-44b3-a599-4a8de96c02c8", "comment": "Malware payload (Mirai)", "value": "9cae6556a8c6789ad07eeca2640145c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037143, "uuid": "60f24904-eb15-444b-99d7-29be02826f5b", "comment": "Malware payload (Mirai)", "value": "1609198cc39a75dcfa8382d1f70d4fead035306446fc95b48971f977910181ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037143, "uuid": "ba9b2aef-9125-46d1-8cc6-e504085605c3", "comment": "Malware payload (Mirai)", "value": "d312a2a3f22ce272267dd88fca3e92851de1bc44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037143, "uuid": "23d439c7-35b0-4a10-bc0d-fa4d55643999", "comment": "Malware payload (Mirai)", "value": "8bb40ce422fd0e279171c13cc65184921ad5f8fb19db9cb1d66d2fc84186eaeb764234d3ea0d01d26f724f7b0d260da3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037143, "uuid": "8d4446ac-9bd8-4bc5-b929-1d4ed9d2f17c", "value": "T158044A02735C0907D1532EF1263F6BE193EFD5A124E4FA44650FAA8A9272E72158AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037143, "uuid": "e1ff0bbd-b11a-4056-98c3-c4d956874e0c", "value": "1536:hKkbOXrtGh26Ul8riIHoLGqGe7J8GJFAmSxDxfg80/+Mcj+u8fNaMZlSvAUhW4MD:MJXrwGiipLGqnVjSxdwKjb8EeLUPpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037143, "uuid": "db3f9b53-e115-4f58-934c-ae1bd4f10417", "value": 184024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037143, "uuid": "e5542246-8c22-439e-9bd0-ea06f6981e81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037143, "uuid": "241048b1-96fd-4bf1-9ea0-7fc22a0ed725", "value": "kurayami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c8b701-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080865, "uuid": "733d5d8d-b875-408f-b0de-79fe6f7cc197", "comment": "Malware payload (Mirai)", "value": "c2d38ea8ce3fa4d38504856bba558c1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080865, "uuid": "f3e70b99-e7f1-41fb-8196-f6cd7322c3e5", "comment": "Malware payload (Mirai)", "value": "16572b971b226eec0991b9e545096ef3bc35687198a0ca3c869930cc7ff57bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080865, "uuid": "ac5116a8-8360-44c1-924a-656e87a9248b", "comment": "Malware payload (Mirai)", "value": "fa26627b6980f433e873c438daf07550d396970b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080865, "uuid": "3b24cd30-ef05-4f8f-b138-645954b6debc", "comment": "Malware payload (Mirai)", "value": "e2d77c4239d884ffc6b1ace69aa1195b5981442aaecf62fa88778eba87cc640484b3841403cf544a2a88c68d964e6916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080865, "uuid": "6484caf2-a9e0-4346-b9a7-4a83c883ef05", "value": "T1B19484BA7750BB9EE368C13405F353E5A3B2139226929205E07DCA3C1DF138C59DF9A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080865, "uuid": "80e03cab-df63-4b33-8ebe-db5c2bcaae96", "value": "6144:fuoOxAp3SI102NO3/cMtmozzTSR9tVhaL7RhuK2jpajqoyRW/+Jxu5cqlZBU/2b:fuAiOO3DTvSJVhaL7Rhrh2PuicU/2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080865, "uuid": "75a484e0-8aec-4e43-b20f-b2bdbb3daa7e", "value": 430984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080865, "uuid": "80588573-d941-427f-9c45-9d36cf625113", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080865, "uuid": "8206fe35-28d9-44ab-8035-15b68bcf1d3d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03ec82b-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057391, "uuid": "54108a90-44d2-43a4-807b-8057be68d602", "comment": "Malware payload", "value": "a112765dd04547072d649afe7deeb3b7", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057391, "uuid": "2996b5d8-d671-4e20-a296-6bc7bf33b6b3", "comment": "Malware payload", "value": "1693448804bf1c90ad7317af250bcd6ea021256e33e983b224aea81d4ecc2e20", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057391, "uuid": "3292dc22-43cc-484b-8b5b-2e5aea0026b1", "comment": "Malware payload", "value": "3d93f46449d76aebd41cf77144839e83ab1d42a4", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057391, "uuid": "ec12b789-e3e1-42a3-8eb6-23218c049739", "comment": "Malware payload", "value": "b1d301a3022ce7348ed31b8b3a5106295f13d82eb59db5613e1acadc04322edc12fb4e06a264cac062419d672f5a97c0", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057391, "uuid": "a0013c78-726e-484f-a92e-342bf0466c5b", "value": "T11B37E0166580F032D8A20E369D7ED6A425377D209B15D8BF3BAC3A1C9F77A82713531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057391, "uuid": "e8f578f9-c796-477b-9119-ce5fc9032097", "value": "9eadc06032fbb15efff2f4bab49bdf00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057391, "uuid": "50f25ce6-0dbd-4381-afcc-236ec8f3f14a", "value": "393216:tXPuTXgI2o47JnfO93q43cFezmX7sMv6WNjaGixiHcumCNl+/gWti:TffQU7sMiWNjOihmQl5Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057391, "uuid": "7d98a8ac-0182-4901-8520-fd4db73f9b16", "value": 22836224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057391, "uuid": "ec7d0d7e-2610-42f9-ac33-5835e2ddf1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057391, "uuid": "6918f933-d6bf-48a7-97ff-4a38011b5d0e", "value": "1693448804bf1c90ad7317af250bcd6ea021256e33e983b224aea81d4ecc2e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcd90ae-2d64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775004693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775004693, "uuid": "0b4f2206-aed5-4551-a096-a861feae75ee", "comment": "Malware payload (Mirai)", "value": "acdec8014b63dae4bf3a209e2f14e8ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775004693, "uuid": "84651d69-9124-4af3-b28a-66e895eed70c", "comment": "Malware payload (Mirai)", "value": "16f69274db76257ba627b00ca7787ca700f4bbc1260707d8e9949ab958817b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775004693, "uuid": "e4c89748-c8eb-4e4f-b1ba-8bfbeebf90ee", "comment": "Malware payload (Mirai)", "value": "3df996710089809a488bede08b501d45633a3361", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775004693, "uuid": "55b85a51-c947-4243-bdb6-cd4b050a8a1a", "comment": "Malware payload (Mirai)", "value": "e1f4d203356e0b63e22680568a8f51a3ad3db20f36678a46488e312362219fcd8009ca611f48241894a34408b72d1767", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775004693, "uuid": "e6032447-5ab5-49ac-96ad-8becd2843a32", "value": "T14AE37B8BB7026CA2C9918BF54BC747AD2B6312115F5BCBE76C0C6A3D4E219DD5E0B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775004693, "uuid": "03ba0d9b-cec8-43e3-8178-0123e22db8ab", "value": "1536:344o/gvT40qIYqqwhLgfKq+eorWUGip1ogLgI/LWaFmCrmKmuRl:oMeqNZUKJXGip1ogLgIqadrmKmuRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775004693, "uuid": "aa881905-77eb-41be-8527-90b81a8bc5ce", "value": 150664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775004693, "uuid": "464fc22a-0d6a-4b13-954a-0364f9992e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775004693, "uuid": "8661b5d0-dd86-4551-a921-fbf90f09ed23", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b0fc31-2d91-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775023921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023921, "uuid": "15f4ab15-aa52-44cd-860c-a30a8c058647", "comment": "Malware payload (QuasarRAT)", "value": "97a03496eaf3641b196f912a852b0221", "object_relation": "md5", "Tag": [ { "name": "Danh-sach", "colour": "#8A3246", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023921, "uuid": "5a83abdd-cbc9-49cc-b381-a97624c11cae", "comment": "Malware payload (QuasarRAT)", "value": "178f2fc720bda22645ce68e6e68e4a2ddfedbb59e2c4163171652a27f0db5bca", "object_relation": "sha256", "Tag": [ { "name": "Danh-sach", "colour": "#8A3246", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023921, "uuid": "e1d4b3e6-e676-45cd-90bc-130e42c3d6af", "comment": "Malware payload (QuasarRAT)", "value": "5a10bf13526d4c770d5b5a56ec995b864d843576", "object_relation": "sha1", "Tag": [ { "name": "Danh-sach", "colour": "#8A3246", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023921, "uuid": "e3a03929-d43b-4311-8fae-51d36358ef97", "comment": "Malware payload (QuasarRAT)", "value": "b23c30ea4e71e92cac3ba60643baec7091658c85dc4c1922130cb55dbe2372ace29bd0f8466d30b70794f4cb4449ea40", "object_relation": "sha3-384", "Tag": [ { "name": "Danh-sach", "colour": "#8A3246", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023921, "uuid": "4a511a4d-61d5-4420-9342-c1cacaa88b07", "value": "T12965F119E7E405F8E1B7E574CD874A06EB727C4947B1E6CF13B069A61F232908E39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023921, "uuid": "e0c5b078-1427-47d1-b972-d4b228be2cc0", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023921, "uuid": "8e275d55-c8b0-4e8e-ae28-e96d7e6aa472", "value": "24576:Xb2+CvRSEHiRkTJrpfGanK3j9pm5JDFtDn4a4k8CFuUAVOhgav1AdCdP+cPJ:L2hvRhHukNEanK3j9ITtDtsCF3AVOSah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775023921, "uuid": "8b08a643-19f8-4d8b-9454-5a77d486a692", "value": 1536121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775023921, "uuid": "370d8f25-bd6e-44d9-a9c7-19e608af9125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023921, "uuid": "fc1dc666-0fe4-4afb-9591-a7fed49c9978", "value": "178f2fc720bda22645ce68e6e68e4a2ddfedbb59e2c4163171652a27f0db5bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdbf67c-2df8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775068284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775068284, "uuid": "a6fbaca5-e788-4093-9b55-2b2513e836b9", "comment": "Malware payload (LummaStealer)", "value": "b18f0c438fa60462e0adacf32efb5d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775068284, "uuid": "d73d5cf9-2458-4ef0-ada0-3f6c9a71853d", "comment": "Malware payload (LummaStealer)", "value": "18583cd242abdb7d4e1df46a8082c3c5d8ceb498a1bcabc3432ebdc244addf05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775068284, "uuid": "31053d03-31fb-4d70-9b18-44ee45e86d4b", "comment": "Malware payload (LummaStealer)", "value": "a2c3a43fd2c1366a3540d6f853494df98064cddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775068284, "uuid": "a4080c99-b374-477c-9a54-fc59078ffb06", "comment": "Malware payload (LummaStealer)", "value": "64892870bbb2dfe13bd2d7c4b10d7b5cf838ddfc3f40bfb835692449b290fa0baf311fa126c4d5e96410bd85649f462b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775068284, "uuid": "423780a4-219a-440b-9a43-c59a925604c0", "value": "T116366A43EBC219D5F38904369E044601DB29E96997EB03B1302C2199EF97397BF65A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775068284, "uuid": "168f0180-0de7-48c1-92a4-857afc37a451", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775068284, "uuid": "55bda6c4-651f-4f68-8932-bcf641e98bea", "value": "98304:poFpafW4nLrHp/qKm2/Sb/gqAZj+UzKb3HtF:dfWerRb/G8+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775068284, "uuid": "d9e97665-e4af-4994-8821-251712cad999", "value": 5128192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775068284, "uuid": "53c00359-e08a-49a2-b9ee-7615b4b08541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775068284, "uuid": "87e72d07-5131-49ac-8f1d-0698dc81310d", "value": "18583cd242abdb7d4e1df46a8082c3c5d8ceb498a1bcabc3432ebdc244addf05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935823b4-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775038042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038042, "uuid": "bd9bc173-ae58-4002-8ce3-11fe023dd3b9", "comment": "Malware payload (Mirai)", "value": "71fbf5b5576ba64c19d71d42f42e7cc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038042, "uuid": "78a5b8c9-9477-4976-bc7c-3806df43c4ee", "comment": "Malware payload (Mirai)", "value": "186023f1926a95effbaafdb8d504d97d29c3fff650f27da7e1b70ac7b5cf713f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038042, "uuid": "e7c06204-d991-4b87-8802-ac92302d0526", "comment": "Malware payload (Mirai)", "value": "65cbc4d4daa706a53a0d405a7887982c6bf69fa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038042, "uuid": "1537f5cc-c064-4f87-bb69-cd385e9ef106", "comment": "Malware payload (Mirai)", "value": "0f86d0e2a8cbc93e089a10b8af3c8b4323c031cb16e057f56c1d444cb6a40ba336d8651dbc013f37c2a4fb372fa95c05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038042, "uuid": "c404f92d-0aee-41c6-8967-fe4430c1bb70", "value": "T1C8E3398CF58FC1F6DA0788308066F7BFCB31A4254076D68EEF95AF35DA275829216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038042, "uuid": "5a3beb5e-54c5-401f-88c7-522fd3dafd85", "value": "3072:Tr+UdlptN9Xr4QfJThvz4y6wSPd+qMgXR8/O2+:eUdlp/9MSThrSl2O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038042, "uuid": "47774dbc-a554-4fea-a653-06ca1194cdd2", "value": 151084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038042, "uuid": "5a612d05-8109-49b3-a2a8-aaa423f5cf0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038042, "uuid": "81e33b8a-f70e-4590-93ca-6e11df71c2c4", "value": "kurayami.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98005215-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045781, "uuid": "bd2ef84e-5757-4c99-a5d1-f3a28f54af64", "comment": "Malware payload", "value": "3a37a278b6820045a46ab8009c4ed1bd", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045781, "uuid": "e0bf1d5e-bba1-4b06-8c99-2183902e8968", "comment": "Malware payload", "value": "191860d5f0c5b1740b22934f0b3a70022dc10d956f7b7b25ccde0215118d9205", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045781, "uuid": "90e44325-b0cc-437b-b360-b9c9cf428cad", "comment": "Malware payload", "value": "e8e9928c97d4aa13c6bdf63fcbe884ef37c879f6", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045781, "uuid": "37bae08d-6fc7-4c1d-bf6f-4b98aa75fc05", "comment": "Malware payload", "value": "d4ee4102d90e127b3c02e548964e4c48a1dc0f26ecb571bd2ad06642dde6466bb4338b7e80be839f5c4bfea2a2a69151", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045781, "uuid": "f17f93ba-e67b-4ae6-a434-e5a28a36fb02", "value": "T103D0237961D1E35D0A464775D024AC198D05C40855284A81B6E9880BCF1013CD1046CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045781, "uuid": "1f5c9186-ed57-4c1c-af4c-d69b0cb74a34", "value": "3:pFAzXbJJFIShsTY7CM8beSEetmAOBbAVWLczhYJC1Ke0GgEfVv+K7dBbJwJJFIwu:pFw98SAYV8bNEFcOzelfVtxJ88wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045781, "uuid": "13fd77d5-9357-44ee-b160-2dea273e0570", "value": 199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045781, "uuid": "3c5e3121-755f-4d7e-8851-f862b1e4de61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045781, "uuid": "79acb0d7-7176-4960-a43c-f2a60a94f4e2", "value": "clickfix.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ac42f3-2d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775014744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014744, "uuid": "5d9b8b6e-df48-4deb-9334-5e7dc0008016", "comment": "Malware payload (PhantomStealer)", "value": "86cebc1020a096332de6fdc2839fbbdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014744, "uuid": "bdfadb13-f0e9-4060-b48c-f87f21e15494", "comment": "Malware payload (PhantomStealer)", "value": "19269ce86552c69219751cde2cd3cedcaeb2ac7474a2d279f024352972ac69e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014744, "uuid": "1e84a12f-0252-4abb-a613-f6b91c04dec6", "comment": "Malware payload (PhantomStealer)", "value": "33f8569a671bb95f29404de3e228a62b16082f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014744, "uuid": "bc390aa7-9394-4391-8f93-d27ac3672c08", "comment": "Malware payload (PhantomStealer)", "value": "45aa71db2c774004c43e8050b613d76c8a7739161a7994cb5723144cfd18211329482cd1669bc6220125f1119ad57384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014744, "uuid": "baa4de02-a700-4887-8cd6-eb4f7aeaf9d3", "value": "T1D87512083359DA02D6C22FB00DB1E7B857B89E955823D103DEF67EEBBD393456D09282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014744, "uuid": "43809d2d-13ee-4778-8f16-ad9ae7bb435a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014744, "uuid": "95fad694-ecc6-431b-ba1e-fb3730155064", "value": "49152:7qUw36sFUVQ5u4lntxgDCFx9HpTPFIOkEG/:7rwKsFduMtquFXJ2Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775014744, "uuid": "865623f6-da0f-4fd4-9802-2ee308376e46", "value": 1665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775014744, "uuid": "1b01fbb9-17c7-49c5-b12b-5a34c9c7c258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014744, "uuid": "582a8ff2-a96e-4d25-9727-0a7e3a8e861c", "value": "Purchase Order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e0d79e-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039179, "uuid": "08942a80-f30f-4d76-88d0-917c0ac141a7", "comment": "Malware payload", "value": "5acf6377069e13a74c70111e6158e38f", "object_relation": "md5", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039179, "uuid": "af334306-8e63-4992-bf26-b5ba5b8cc23e", "comment": "Malware payload", "value": "19680b70becbd4f0a44115dfa79a717603d530e2826cc6ff6d5645baba9a05c0", "object_relation": "sha256", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039179, "uuid": "97964676-008b-4c3c-b7f2-e381b1f20952", "comment": "Malware payload", "value": "2eca3987a5114fa31b95fab34a1bd3263260473d", "object_relation": "sha1", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039179, "uuid": "d366d6cf-2b7c-4a66-824f-b6d96ef48e50", "comment": "Malware payload", "value": "84b33a541148e89936da6c52f2bbbf0b0c01c0e15dcf8315a7584cd86ab19c53622cf4e19e258df4fe37c1017f92d362", "object_relation": "sha3-384", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039179, "uuid": "9de598cc-4cd0-44eb-88ca-6a5e4c795499", "value": "T1214174F2B7395831B34EC0ECA90572B2B8534FBF05A9BD50F0A24F5C062D45C102AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039179, "uuid": "555d0af6-ff1e-45e9-832a-5c86c0c1be26", "value": "48:0jKSHi+DF6205Mlh/WuzoRuqWz4MJ0yQOCE:OfD9a4//ok1z4Q0LvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039179, "uuid": "61a17212-7584-4c55-a851-40e3a4a36da2", "value": 1945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039179, "uuid": "2a7c6b06-a041-431e-a738-e256e88319cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039179, "uuid": "9d6c6b48-949e-492b-b6b4-157f1135877c", "value": "19680b70becbd4f0a44115dfa79a717603d530e2826cc6ff6d5645baba9a05c0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aa5901-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775060326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060326, "uuid": "c8334195-3c09-440d-a8b7-76b5fdc25ee7", "comment": "Malware payload (Mirai)", "value": "9f16e5596a7d2fa48d7be03a71fdb21b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060326, "uuid": "0f3e16f7-ac22-484d-bb63-732f19242aae", "comment": "Malware payload (Mirai)", "value": "19b0d78cf757f06e536c795fc1166cb5c469f17dd0eb0e31897aa9b99f6f6b6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060326, "uuid": "97ade5c7-c1f6-4d17-8920-195be7ffd84e", "comment": "Malware payload (Mirai)", "value": "39355f26200d4678b3f7efd5e6e92dc9ac92bc6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060326, "uuid": "25487eab-df5b-4646-ba59-b2b06e4878ad", "comment": "Malware payload (Mirai)", "value": "1e642f7c55a2c263ebd70f378fa78e96a1c12f09e71b9655cd7537d6e9dbf886cdc3bfd1a607c5df901054b56cd5d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060326, "uuid": "45124264-981c-4294-84e6-745fba1fda3c", "value": "T1942301C391BBD4BDC421EC77804981C6EB718E03F387AE2B966F9ABC98943516C31128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060326, "uuid": "364b4482-4e44-4a00-95a9-2a4e4ff6ac17", "value": "768:+CSSdfRHMych20IgWTxEvOcnFUXFA75FaDenUMY4OakAz4s44SONlKYP:+Cd/Mych204xEDFUM54DeUN4ZE9IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060326, "uuid": "15df6138-4ba6-4c42-aff9-7a8231a6d70b", "value": 47828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060326, "uuid": "74c04fa9-e902-4ee8-905a-0cabc27417a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060326, "uuid": "40cd0a03-22c6-4cc2-8a66-9bce52440159", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6679ba91-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040114, "uuid": "2bf7bf15-80fa-466f-9dbb-4c0e794da998", "comment": "Malware payload", "value": "596982d542be067b07077a9dc0e1dcba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040114, "uuid": "6afcfa7f-dd1a-41f3-94cd-e7be5c22ec52", "comment": "Malware payload", "value": "1a0b015f10ddb6773e33e27b07b24b1cd24a5095409173d587c7cdd247169c7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040114, "uuid": "5cdb5ee6-f91c-4803-b26b-bb4ec4de2492", "comment": "Malware payload", "value": "89e8937786fdd7cdce680c53d2b65263c002610a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040114, "uuid": "576f7cfa-cc3d-4ca2-9b06-92e9b6d2fb35", "comment": "Malware payload", "value": "1c8dcf2bf4c0fe55de91b4b22f8fe7512b2434d96d38677cbd9536edc7f19682df661da87abcc6c491d7ddd5ec5c4551", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040114, "uuid": "e28ce1a8-f735-402e-9f9f-279d729314f3", "value": "T1E3C633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040114, "uuid": "01540ad9-59bd-4117-8141-f0f7c485d804", "value": "49152:+6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOcC:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040114, "uuid": "5376fd15-4dc4-4b75-af1e-8966de59e0cc", "value": 12190268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040114, "uuid": "fe8cbe81-2139-486e-aacf-77d0cca3ed0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040114, "uuid": "6cf3cf66-8b47-408c-ab85-fda3495bd4b8", "value": "1a0b015f10ddb6773e33e27b07b24b1cd24a5095409173d587c7cdd247169c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0927d886-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053702, "uuid": "ac9b964d-755b-4409-b1cb-8b61aa16a163", "comment": "Malware payload (Mirai)", "value": "137709bd8681022858a2f4348ebc9f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053702, "uuid": "c9b40913-9cc8-4643-b212-eb8fc9a8478f", "comment": "Malware payload (Mirai)", "value": "1a17aef011c8838024e5c63540de6e46583be4a597b2ca8b0005bbdfe126b4a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053702, "uuid": "f3fc7ea7-21fd-436d-a284-1e0670a621e8", "comment": "Malware payload (Mirai)", "value": "835fafb1ab6a9002237403e1239264693886555b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053702, "uuid": "2c2164c5-b959-424e-810a-e3bbefd1c69e", "comment": "Malware payload (Mirai)", "value": "9b1475753d98489564e7f0f0d2142340adc42b39aeca519ea253aaec4536e3e8c72d63b3c2c9db13d483b662f9b3b682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053702, "uuid": "01b11f69-5efa-4d6a-97fc-74a7d85b8d74", "value": "T102145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053702, "uuid": "ead97f12-f18a-4d54-8763-c4b12428abc0", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXtUaN:HZ15BTYCrYq1QDY6u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053702, "uuid": "4de0d394-8a9d-4cd5-8b1f-0f984498d103", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053702, "uuid": "afc22713-3127-4845-9cb9-8e6439e25dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053702, "uuid": "77eae4a4-da0e-4a17-a05e-c6eff1b32b6f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd3a0bd-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039507, "uuid": "9d73e6af-d80c-477b-9639-0850183603f7", "comment": "Malware payload", "value": "ce3aee9c447cecc2907af53a3ab01757", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039507, "uuid": "5310591b-90cc-4920-b3e5-747cd98e0b59", "comment": "Malware payload", "value": "1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039507, "uuid": "531ad46f-436d-4f0c-88c5-720aafdb98c6", "comment": "Malware payload", "value": "c37d4e571b13367224c8cc7234fc093920c84a9d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039507, "uuid": "6db7e12b-6dea-455e-bfeb-c05523730c2d", "comment": "Malware payload", "value": "1c7e9ee6ed620462c1ed4adbc2b1833fd845a334a25ab296ecb1f06cbc2e2b7da279a07076e29fca16d02cf692208fad", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039507, "uuid": "51796bf1-1567-44cd-a116-2389afab3e73", "value": "T19146021755D493A8D0C3873076CB4397B1E0B55A89BEA92A33C67C027F22C9B534BA77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039507, "uuid": "3012239f-919f-42e4-b7d3-0e04a3387cd9", "value": "98304:jURCagGy4Y9HlRlxOH7ZhWIOUbzshvDPQ0vGcgCinSf:m44Y9FRlq7Z8giE0vGcgCin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039507, "uuid": "f6769464-2eec-4c87-ba13-dd9cbc990277", "value": 5693232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039507, "uuid": "e894e0f7-deb0-45a3-88cd-b4b8bed92f86", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039507, "uuid": "7cf6b97e-de92-4410-b4a4-809f1aea3906", "value": "1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a1de5e-2de9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775061826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061826, "uuid": "c676782c-cf89-4278-a915-ecc3e12785d2", "comment": "Malware payload", "value": "5a4bc22e05f91fa76a2fd832be5a64d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061826, "uuid": "a47e950a-f70c-44d8-997f-5bb6a330d662", "comment": "Malware payload", "value": "1b936fdc6ccb8a238952dc1b53720aad3f68e37f01bd03ddfb5ac6bc742bbf7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061826, "uuid": "a4be2b53-a531-4589-b2cb-27bb2c83468f", "comment": "Malware payload", "value": "4846eea4b52e879360334e27a2d5726251841e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061826, "uuid": "929aea12-1ec0-4c5a-aa0a-3ffecfa4f961", "comment": "Malware payload", "value": "40c88d319de05294fb250b407939ac8785a8b6b7fbbf2715b052fde3940aef0c7470ca24ef87f2b6a0825be20a895e3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061826, "uuid": "f90aa635-3768-48ae-bd10-e6b5ab133466", "value": "T15CC31956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061826, "uuid": "7d3ca2c4-7101-427d-b122-9a7390e66f37", "value": "3072:/DDfYAjolsXe+aSc/8D+RKTVDNhQYfCYXEVH:/DDfHjHXda7/8RTVDrCY0VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061826, "uuid": "129b66b0-8396-46bd-bc01-8b29a136693f", "value": 129276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061826, "uuid": "c367e54d-8acd-45bb-9e3d-08176bd5e3ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061826, "uuid": "c38d86bb-8b94-4ea4-87e9-5401270fda97", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ea12d2-2e13-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775079575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079575, "uuid": "6716fd74-c0b0-483e-ba93-f35c5743c90f", "comment": "Malware payload (Mirai)", "value": "70b6e9f037805aa19db4a6430863a31e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079575, "uuid": "a7d7836b-6718-4067-a9ef-236d9244ca45", "comment": "Malware payload (Mirai)", "value": "1bf18387fa3b99191390b060a9dfd9ef56ec7d0f80d407cb278a933d7696cb2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079575, "uuid": "003e2a5b-4d07-4908-8c26-2d8758fd267d", "comment": "Malware payload (Mirai)", "value": "45c1952e58bd7a99e52c90098bdaca40c2210e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079575, "uuid": "b5995a63-de28-488b-9bba-f905e474a6ce", "comment": "Malware payload (Mirai)", "value": "5eede168ca40cafa0f24393e873658ee679c48f36fcc7fc01d13f3578cd8b32ce49f7df81feacdd96728f355d5e0e5ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079575, "uuid": "a5ee7b0b-0f21-4573-8b4d-65b066f5f4e7", "value": "T1C9B3F845F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079575, "uuid": "49ce13af-fa7f-4c28-86b9-18babe3fdca3", "value": "1536:t7jnPq8azP4V8YOT0lVHyNOr4umIwYeFudPlYJowywlQ3Ym33b/VhoYCk+QE:BzPqF41OolJ7mIxe0bxyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079575, "uuid": "d74e6d20-e7d9-4694-a249-81deff776363", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079575, "uuid": "194a038b-6f0f-4be2-8dac-6c8f74b61124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079575, "uuid": "32e4dd06-4a33-4d65-9d74-28867ced904d", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c217d36-2db1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037466, "uuid": "556bdfde-7c64-46df-85e8-689f370fa8e5", "comment": "Malware payload (Mirai)", "value": "9f991348778ceb0e4599397460ce6c8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037466, "uuid": "c1165299-c8b8-4c07-86d0-a4e55fd5d4c0", "comment": "Malware payload (Mirai)", "value": "1c580da3046e1cd892f51f3af3c327fa4c5c19435574f8e6277c4173bfa18ad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037466, "uuid": "644085c1-b589-484b-b934-7ce94a47c5c3", "comment": "Malware payload (Mirai)", "value": "caf8380956d2523e5a81f4f8590da4df889b78ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037466, "uuid": "5ad74d78-8413-4db3-b6d7-97c582c42917", "comment": "Malware payload (Mirai)", "value": "3c4a03c99c5da57473d19f62b0a1a97f7114c8578a6693483a1e14603645664d4bd42882935b85c7215aea1f39e2114b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037466, "uuid": "5d74764d-a63f-46e3-99fe-2b597d8be9e4", "value": "T1A463023D572A36B969F860368042DAD3E1DBE3BD91BFB4AC0051C1DE2D9C0670B4E59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037466, "uuid": "b5b7e4af-cbfd-416f-ad3c-9bc40ed1c8cf", "value": "1536:FZlqTVq40QhRrsw0qakCyaL7zgCHtVnjJ7aaznznzP:HlR4Fvow0rkSgUtFcEnzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037466, "uuid": "0d7bd118-c963-4226-b76d-2f027ff4b7ca", "value": 68872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037466, "uuid": "a085405f-80e8-487f-9674-d6d2619c8243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037466, "uuid": "2d217f64-8f91-452b-a0f8-8fd8dfa855a7", "value": "kurayami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370990fa-2da3-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775031445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031445, "uuid": "3485a6c0-eb24-4bdf-9205-41f2ac9004fc", "comment": "Malware payload (LummaStealer)", "value": "96526f09db359ef372d2544e30294005", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2141", "colour": "#3C208F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031445, "uuid": "a72a9ff3-3ab1-407d-9217-0b554daf73d9", "comment": "Malware payload (LummaStealer)", "value": "1c772de0c40755f2516f57a86a8a0cbe58201a79a191defbb285946574ee3d2c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2141", "colour": "#3C208F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031445, "uuid": "8e41df7f-aa13-463e-b0de-f9913aa4c95a", "comment": "Malware payload (LummaStealer)", "value": "42cb56c645c61f19b00494a30d341177c16564cf", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2141", "colour": "#3C208F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031445, "uuid": "9d2849d0-c765-4ef4-8172-2569ee64e674", "comment": "Malware payload (LummaStealer)", "value": "7e6a646f5698d03e5f120bfd9407b748561c329b1a2d9286eef25f6bac0d43dfbc40fc5f3976bacef87fd65da6ccc9b5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2141", "colour": "#3C208F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031445, "uuid": "01d1efda-968b-4483-b2a6-60d9bb6c4a93", "value": "T124E533F176897A30A636019E35C9793F33439491FEF72A9B14A2277C266C93B0F4B944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031445, "uuid": "83bff526-4d59-45a9-9dc6-8633ae0b4acd", "value": "98304:TkxFJXe0tWK5lVAkKOiZqWg63HDAz36QF:Te/O0tWKnVAkY7F3HSzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775031445, "uuid": "af21beff-337f-4403-86e1-2f3ccf4e58da", "value": 3270995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775031445, "uuid": "451ac931-4e16-4929-8ac9-90af7f12c0ae", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031445, "uuid": "c61a7d0d-7042-41f7-8815-13dcbce81cce", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6ce55f-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775035888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035888, "uuid": "54629a79-e455-47a4-a92d-3803dd81355a", "comment": "Malware payload (Mirai)", "value": "14c01200dc2e470954d583883041ab48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035888, "uuid": "97510741-aa22-401c-a62c-09e2c1ec433a", "comment": "Malware payload (Mirai)", "value": "1c912c5fb80edc312de11238b21d63f75fdf8e8221926a53dbe99d02a454815a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035888, "uuid": "558468a8-e8e7-4818-89d1-e898d2eddda7", "comment": "Malware payload (Mirai)", "value": "aa062f0148cb46c5362d04eb4002800e63e49148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035888, "uuid": "12235194-13d4-4a88-9ed2-5f73fa9bca02", "comment": "Malware payload (Mirai)", "value": "38e4931610f5c5df6b1498e0ee55562ba9272741af17d4ad6fc7f51d6b5795ed23075f6afb08da76c9dd525b16ff278f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035888, "uuid": "60b0be2b-6587-4d50-8fbe-0ec4b11d7052", "value": "T1AC04BFA3B34F2491C87106F80BCB6B9D262361125DA7DAD76C6F753A5E375DE08023E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035888, "uuid": "3207a269-f401-4c3c-ac7d-d194b73a432d", "value": "3072:ADBdjwnSSY0VLtsYPtkchPPd2WenqkxJjg/ClTK3Kiyqq:mX0LsYP2chXdCqk/yCdK3sqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035888, "uuid": "b53eaae9-4b19-4b61-a1ce-9c541b9b3aef", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035888, "uuid": "7d9b5428-2ec5-4f96-af9d-de27e6d792ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035888, "uuid": "f30dc354-7916-42b1-bbe6-2971bfe7c0fd", "value": "kurayami.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d5ef7d-2dac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775035494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035494, "uuid": "9842beb9-1521-4693-b619-2cd66d8d7408", "comment": "Malware payload (Mirai)", "value": "872ae08626653a323cca7154fdc5034a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035494, "uuid": "8dae87fe-28cc-48bf-adfb-cd535120133d", "comment": "Malware payload (Mirai)", "value": "1d57ee028e58364660d400a755b67058b2a211b43c62dbfe16f1b316104f0e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035494, "uuid": "92cb9c0b-f7dc-49b5-93aa-33e565cf9d66", "comment": "Malware payload (Mirai)", "value": "fb52916d84ddf7bb9f6715184abc238e1a0e006d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035494, "uuid": "1743606d-15d2-4d55-8aa8-48669c91ae2c", "comment": "Malware payload (Mirai)", "value": "c8a75757c0a305310f6747502f9312e2f868a08e6d9d7fe6a7e084b39aa10fd44b6ffe9290d9f7c4ff9f8a653aa46a4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035494, "uuid": "e3201859-de1a-445e-bac7-a9151f644200", "value": "T12BF39D33C965AE98C6649474E0B1FE795B539A0641871FBB1AA7CBB54043DCCFE043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035494, "uuid": "369d29c2-cfc8-4150-b74d-4f3947323169", "value": "3072:nJqn73FvDaOmynee0PI71NGH19rVCUQLhQhWjEKpGhB:nJG5aXeEH19M1QsjvGhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035494, "uuid": "4f088736-62be-425b-ad8a-cc9ddbb98280", "value": 164704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035494, "uuid": "861e54be-7c86-4057-8932-c104ec0c258d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035494, "uuid": "83fdd51f-afbc-43a9-ab3e-1ac626c170e2", "value": "kurayami.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0d2cd9-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057792, "uuid": "7882cd8c-52a3-49a5-bf05-cba7470ee990", "comment": "Malware payload", "value": "db1f1c32fbc3424488ad78f9d03ba81e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057792, "uuid": "2e710837-78ff-4a1c-b85a-3c920ae09251", "comment": "Malware payload", "value": "1dc49390801ae4be6be1568ca9616aa9d9368b4ee5f009a15d69ec73bb453f61", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057792, "uuid": "caed9d95-295a-4a1e-8c2c-210e35a3eee7", "comment": "Malware payload", "value": "f31274a0c850764d076c2d8d5071c170045bada8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057792, "uuid": "abe8dc05-0628-4208-9c4d-b77962bfde55", "comment": "Malware payload", "value": "096d392bfaaf6e4e0b4dca04ddaae2c49bd17940abedc67ec7aba48e95916ef3a639322829615bba375f3547c469cf38", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057792, "uuid": "6c148e6f-c92d-4477-9747-10814af8eb7d", "value": "T1FC54DF14E3F9411AF5B98F55D6FA4814C93A3EAA2B1E84EE48040D8E0E75E44D6F7B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057792, "uuid": "d907ff0d-58f0-494d-a68e-7eb11524b8e5", "value": "6144:QjP+NGZvRSewPcNWXnVp1YZK4Rlukj2L61oCSQ2uw5o5d1R:QkIR4UNWV8rukj2lc1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057792, "uuid": "2d7cda8d-983b-4814-b769-00611c8c03d3", "value": 283142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057792, "uuid": "f2e66fa1-e1c7-4511-ac6a-5dfd64bb037a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057792, "uuid": "e5960c60-4e50-438b-a9cd-d56152e104e8", "value": "2nd_Quarter_OrderList_Full_Specification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdca76a-2dc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045977, "uuid": "9b484cf5-1f19-4153-be37-ab76e5a61484", "comment": "Malware payload", "value": "47110263b23b991fc9548b196dc321a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045977, "uuid": "a8142114-bcc9-4873-9916-fac243ea39e6", "comment": "Malware payload", "value": "1e563640b8de25d76d26b4e04742d2a6425e5eb94e4d5283944a5d14c97a24e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045977, "uuid": "a2b4435e-1f47-4cb8-9d62-90b6a004edaa", "comment": "Malware payload", "value": "3c828de0c2f8cab1d731e0893fabe40fbaac8bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045977, "uuid": "e7e60a36-eead-4731-b323-98edd0148e3b", "comment": "Malware payload", "value": "b931c4b6309088e29055033e4a8181bda5c1749e23711a82ca134cb6228ca877acc0b8ff28e2c1e471b7a9d0babb7355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045977, "uuid": "48f9b912-1598-4722-9bc7-5d0ba1a80856", "value": "T11FE5BE46B3C86AE9D506DE399704E232C1B2B9234F76D0CB1A9AD70A1F76D514F3EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045977, "uuid": "2a402730-f5c2-44b9-953f-2e0368762569", "value": "95fe590d711a44605db848b6a3c68144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045977, "uuid": "db379090-702f-4619-8cc1-1bb37807afb0", "value": "49152:dWTFdhSVA72BcLzi1QEMt2Y44xV2MbsPbpGHvQydaN0btSG8XgW4q9ychMJAF9Wt:vEj9RsPbpGHvQydaN0btSG8XgW4q9ycq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045977, "uuid": "fecd8f76-b833-4e07-bf89-4c77055b7f8c", "value": 3072512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045977, "uuid": "8c98dfc7-4456-4a74-98e1-7cefb29c0a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045977, "uuid": "227b2931-46a3-4221-b442-6618b86294d2", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7451d4ad-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037990, "uuid": "4fce3778-8b89-40d8-a542-767883a87fad", "comment": "Malware payload (Mirai)", "value": "96816d4db24419beda26502574dc110a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037990, "uuid": "97b62b81-effa-4d1b-9a99-e1776af8eb82", "comment": "Malware payload (Mirai)", "value": "1ee1b7c114e3eca3597b10815417d933281dea5a05af2ca23c3445205839e446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037990, "uuid": "162af81f-3f0a-4f68-979e-2fa2fb6e56a7", "comment": "Malware payload (Mirai)", "value": "63cf02ccad2d31ea0b7560f1e23157226873efd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037990, "uuid": "a64eed23-4fcf-4727-b451-0f5593b18366", "comment": "Malware payload (Mirai)", "value": "726bb5ff94292410571430cc5168d2c0558fb7a2dd8d76ddbc4987c637b34aeaf2b43681bc9f789ef004a0fa65ae8d07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037990, "uuid": "6a529fff-91c5-4271-a6c7-859ec0dddfaf", "value": "T1EF7302F1B54E657382A324A6B8B3ED973CEC7A78E48EF50748ACD06AF502D435495342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037990, "uuid": "74ce0766-f629-4877-9415-01990244e723", "value": "1536:kguWOMb9QllElTTTg4GbhbbvxnhITUewquxIf5ZuHT7je7MKnPBvIEFO6afL0:kgGMbKi4hF7tHewquafuH61BfgL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037990, "uuid": "10231b9f-f562-48eb-ae34-5eaa7041503c", "value": 73656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037990, "uuid": "673ae049-2373-493c-aaca-05e8b1e9a7da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037990, "uuid": "4cd8485a-4816-47e6-b5af-5de84cef4019", "value": "kurayami.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afe0935-2ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775056094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056094, "uuid": "3d4c4c79-0a77-44dc-9dbc-56a3561034fd", "comment": "Malware payload (Arsink)", "value": "aee3da1497b436a724978ab0180a7a82", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056094, "uuid": "855056c6-ad74-41b9-aff4-4fdce7986d90", "comment": "Malware payload (Arsink)", "value": "1fc3ba39f0ce8109bcb4f42441250df5e9c601744b738a2e7c40d612cd29fec3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056094, "uuid": "da6dd013-18fc-4692-a4ac-ca6c9e3cd676", "comment": "Malware payload (Arsink)", "value": "5ce5f1429369780420a15f949fea78c3aaca69f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056094, "uuid": "01d3f51b-78a8-4b5c-9e03-ee4551e1f381", "comment": "Malware payload (Arsink)", "value": "51c926635fd06e24b54cb6db64ff7d5f476279c2305d7f0b509f025811c52bc4a6d26900df56642b6019f3339dcef7d3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056094, "uuid": "3fa367af-5d49-4429-b993-e681e28170bf", "value": "T146D312B6EBACA9BBD91F4C7460B4E527FE724273D0E0CB4F0E16831539E157449E068A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056094, "uuid": "4e1bc250-2ade-44ee-b832-e4fc621d0330", "value": "3072:L+lUmWcpyNm1wBMAghNZV68C69/Iyijbx+pTq:L+OipyNmFhN9CK/7Obopu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056094, "uuid": "3921fea2-912c-4656-8ac1-3103f00fa73c", "value": 135861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056094, "uuid": "d24bd84a-d613-47f5-b2ed-3dccfbe65c7c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056094, "uuid": "c718c582-7d62-4aa7-9826-3d54ccebc122", "value": "base (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88018e69-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775063793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063793, "uuid": "5e60fb16-195c-40ec-afa6-8ad0d711d41f", "comment": "Malware payload", "value": "303f695775a0c750e733ed6259882dcc", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063793, "uuid": "a62f4e48-8442-4b21-9806-6813a826c1ba", "comment": "Malware payload", "value": "20cff974367eed6e5b208d69ed49e7a9f50afbeeb60cf2f23a3a2e4ca3f1e08c", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063793, "uuid": "0ca65717-4186-4dc2-841b-11a819d9f289", "comment": "Malware payload", "value": "ea879e410bb69b4a1869c87509b4fd92e8577399", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063793, "uuid": "3bea8d13-b3b9-4095-b15a-82a041615e0b", "comment": "Malware payload", "value": "fe62fdca8065c7e2e33031b7d64ca0abefa8e691b4bce1fb2da7ea3544b03177a4f973d75a3f22e5ee2f492185990e80", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063793, "uuid": "36fb9aea-ed68-4328-8686-767eb9c46d24", "value": "T1164401BB59C97E3EE81D48F788A374B0B2550C0B9974B5601A032BDE8D9C58C06975FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063793, "uuid": "7d4d9cca-0bf8-46aa-a242-82472e7c1d13", "value": "6144:88Hxktl5lNXlEMsBkUK1pownvPo1z1qpkPCGdi7jWzYpGU:8aktl/NXlQBkUK1DvgdIezdi7aXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063793, "uuid": "a9679b9e-c30c-4fbb-a2a7-32d39962e4d2", "value": 278420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063793, "uuid": "fcc94454-aba2-464d-8497-25de9184a0b7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063793, "uuid": "cda47c3e-e349-48e5-86f0-3e119d3284bd", "value": "20cff974367eed6e5b208d69ed49e7a9f50afbeeb60cf2f23a3a2e4ca3f1e08c.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378fad61-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057645, "uuid": "31436101-6559-4fbf-876f-16605789d46f", "comment": "Malware payload", "value": "db9cad38034cd632ee8cabca8798eb10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057645, "uuid": "5007df90-3384-4c0a-a9d4-a1af60a67ceb", "comment": "Malware payload", "value": "2142e8e5386e5565cdbf3c83f6165e1eafd4f258ae4fb11d76de5fc1117c35d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057645, "uuid": "69c568a2-9336-49de-90cf-eeed7d196b6e", "comment": "Malware payload", "value": "8cad37659962cc577d5c7c9d76a4e37141189be8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057645, "uuid": "af6afa44-2a69-4005-b78c-1361d93f3a69", "comment": "Malware payload", "value": "4583a04452594547b9bcf47044197e6b2a0440a7cd3c4b25a5aeffa3330e2f54204233e0d08639d80b023c3af8cbc2b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057645, "uuid": "32e94daf-6b1d-4c60-a43a-8c276ec3c52e", "value": "T1F2645D60EE3416578DA327ADFC685971C9BEC919922640F5F7C8030E62016ECD7BF62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057645, "uuid": "206217a4-1e3f-4ef7-8be5-2c116e0cca60", "value": "6144:2tAUeHLxvGMPh79ZxdtM2NYb0y7NWUBPHl:2tAUeHLxvGMPh79ZxdtM2NYb0y7NWUBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057645, "uuid": "c0688ce1-d934-4cbd-b769-93f36c9c9f7d", "value": 316852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057645, "uuid": "0a91d787-cf8d-4a84-a9b6-4f2838e09385", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057645, "uuid": "8f0c58da-82c8-4e42-935f-fec180729bea", "value": "IMG_2026_03_31_3546563411.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c937871-2dc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046111, "uuid": "d746643c-01ae-42c3-ae95-6dfdd673aa33", "comment": "Malware payload", "value": "afe7b9ea641c23edf42c7da5fd4f9db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046111, "uuid": "c575904f-7f79-4c72-a310-a28804b33755", "comment": "Malware payload", "value": "2154678a606be199a523590493f14a0811bd5a08db5114d47b4e6dfe8cc7042f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046111, "uuid": "e622d09f-be66-4e46-a137-02964949f5e8", "comment": "Malware payload", "value": "50ebce250ac3e9bfa448f111cd63d87975b84424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046111, "uuid": "67a3f2e2-6385-4c45-b29a-e9503528ea79", "comment": "Malware payload", "value": "e252cc5287d12408632f31e46ed31a5b2e245682730edf2b69a8e7ba218728efae1da1178806320d8dbe27634d1e71be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046111, "uuid": "010c63e8-665a-4982-b7e2-e56e88770a36", "value": "T1A3F5CFC373C4BE96D10AED75D613AE259293DC234FBAD0CB39521B0B9D767908E34A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046111, "uuid": "f9331916-69b9-4dad-a4b8-600cc521b1ec", "value": "7d4bdbf22c5ce276c67ca6425cf3cadc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046111, "uuid": "152a5d76-2890-42cd-b67e-f6352d710c56", "value": "98304:uGGAS3SC32QRrxbsl4KgqFuKOpA4+9Hp72FJsKexy4SG6admduG/UaCgJ+MB:lGAS3P3LRtsqKjEpT+/FBxZSU0RUa5+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046111, "uuid": "8a21a97a-90e9-4dd4-9993-547f6e67e56f", "value": 3538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046111, "uuid": "07f27d12-df01-41a0-82fb-5998fc72814f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046111, "uuid": "d4b1529e-842c-43bc-bf71-f9ea4b408ea7", "value": "libfzclient-commonui-private-3-69-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f1f8ef-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046552, "uuid": "eac9d763-18d4-42e8-ba95-d602a97f5fda", "comment": "Malware payload", "value": "56dc40a983e211f7ec86076c608693ec", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046552, "uuid": "aa3ab0e4-1177-4e87-9af7-4826c65d9336", "comment": "Malware payload", "value": "22ca3715bdf2432c7522062d006dcc585865344c078f1a7b4e93887702318824", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046552, "uuid": "e264979c-1905-45b8-98c4-c7055c401a64", "comment": "Malware payload", "value": "2a2e8c0f9cc0b17220b15162f610a318aa558040", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046552, "uuid": "68dc074b-31d6-44fe-a36c-e921c2070b49", "comment": "Malware payload", "value": "c8b9485c80c7b7b3205f34d7d692ffcd08f43002f67b352830429727c76e52dcd355273df5a4fcd6780f958595e3a193", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046552, "uuid": "1a02b8bd-7611-44bf-8528-d611aca9dd54", "value": "T1EC33B5B306532F0957D775E3DB4CAEEA40D9E167F61A2DC681B1337ABA40103E0E7A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046552, "uuid": "9de44f84-5807-4bea-90f4-6fb6a72b2cb7", "value": "768:DFCi1+gTEDQD+zqUSDNihO5YoGPbOJOQgZLMK71xL3F928o0Q6SRr/Rp2qcI:Qi1ZTEuEcn/kvMCLLvMVdXVcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046552, "uuid": "44f0ef1d-151c-4ad4-a212-32d55044b62b", "value": 53497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046552, "uuid": "7541f617-e397-46ed-a0ee-2d80ba53a4ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046552, "uuid": "a5b56237-2426-415d-a737-7beb65f73a94", "value": "22ca3715bdf2432c7522062d006dcc585865344c078f1a7b4e93887702318824.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9b7520-2e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078274, "uuid": "38413959-7926-4076-bb9a-f3b4cffaca5d", "comment": "Malware payload", "value": "da673e2f0b4b366559f5ad6f39d78fc4", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078274, "uuid": "af7fd74f-d264-4eeb-bf4b-6181e0129e8d", "comment": "Malware payload", "value": "2326fc72415a61e07ebf4e0c328f7b8a9d465de72ace9fbb4cc76ede5e5a0a2a", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078274, "uuid": "f83f83ac-6174-404a-a45b-08bed4cd6316", "comment": "Malware payload", "value": "75a691c41ac891222dafd8b84d9a223f1f4a14eb", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078274, "uuid": "b1def2dc-d4e4-408e-ac7f-e5a41bee1828", "comment": "Malware payload", "value": "6084a0f02c28346b2d082b410f07fc4e7a587ca549a72531ddc4da1c1fa5dc4f01e136e45564d08bcdbcf941d7bb5fc0", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078274, "uuid": "7d6cc3b4-6564-4b8b-a056-88d603433915", "value": "T1F61733C1B9E0F810FD37DAF25AEDD69F84072E1B05B36102E85B66BE2547662FE5C090", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078274, "uuid": "1a2e00d6-29e8-40c1-b26c-dad87d8b4d3a", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078274, "uuid": "b29c3dd4-9f95-49a6-842d-57c38fb955d3", "value": "393216:F4Zc8qez5Zrac4eSeJV50F2eQXmAAyrTTrXK4s747+UiXeS5Jse9/45jZJV:thejn4OSF2e32TfXK4s73UiTqeepZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078274, "uuid": "f43aadd7-e2f8-4201-966d-30df1a5b74a1", "value": 19738112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078274, "uuid": "9f1fdc1f-ace2-4936-9ad0-2d8225eef7d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078274, "uuid": "381149cc-5fe7-4668-a3e1-b68bebeffe22", "value": "Installer_v1811_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d4e78d-2d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775011122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011122, "uuid": "6b00f7de-2b0d-4c9a-8b8e-9015420363dc", "comment": "Malware payload", "value": "4235b1037f1d481624c4ba42a3cc1cb7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011122, "uuid": "2fa6f552-c0aa-4b99-959c-5d54dab3211a", "comment": "Malware payload", "value": "2497fce4712456158520e03373637dc12867eaa7d13680aa945071e38dda8d2c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011122, "uuid": "75953d82-2096-44ec-8dbf-e7021187d549", "comment": "Malware payload", "value": "aa3361462d621289ad6f73d34adb2ff1fb7d6f79", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011122, "uuid": "2bf0e50f-4171-4080-a847-02f0c4caaf17", "comment": "Malware payload", "value": "ccba6e1cdfed66c018c9633295425b6ee91fb1cb92df243a0fa7f69fcf9fc80067aface9471a5068fd5ce8c8befd6aea", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011122, "uuid": "3d22d37b-c215-4a35-85ae-d7e675083d68", "value": "T16A760137B28A633EE06E463B59B2D2205C3B7F61A51E8C5696F00C5CCF691602E7F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011122, "uuid": "bc588efb-bc37-449f-b0bc-29c408456aa3", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011122, "uuid": "a7548f85-a4b5-429a-a48a-edf09cb7a648", "value": "49152:3N61T1mV9UDc+eI5MuVJKVCTWA5uFDowkLNyOo:3N66V+Y+yd6WA54D0Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775011122, "uuid": "24ed4b1c-0ede-4801-8748-c3b47dc97b10", "value": 7624156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775011122, "uuid": "9996f4ed-82f1-40e7-a818-7ff2e4362bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011122, "uuid": "2c5c4337-74cb-43e5-b62f-a0035d3476b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56e03cb-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022691, "uuid": "ab0b94a8-7db8-4ac9-b19d-40342432dc72", "comment": "Malware payload", "value": "bb283d5e3cbb8a5c9dde2b06e8efc213", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022691, "uuid": "f2ecc54f-ae2a-4c5d-bc62-3ec0be252d55", "comment": "Malware payload", "value": "24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022691, "uuid": "8d641cc1-543d-472a-bc94-38fdc9149818", "comment": "Malware payload", "value": "85d59627014366e8ea595d37d5659bb01557784c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022691, "uuid": "a3f16cd3-bcc5-4e00-87e4-ed56b8b03943", "comment": "Malware payload", "value": "ed8306a0df74b70a6c43586f86e087469d0560ac8ae6ec51bde85422f9173655045a6f73f2f7ddb34da1616b9e66ee02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022691, "uuid": "b7c5934c-9d4f-445f-b7bc-57e1e1941b5e", "value": "T19511B1DD70A9245DAC119E4270918DA0A145F2FF7DA79F48AC884DB1F58BBB4302DB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022691, "uuid": "d81fd259-f0e9-47e7-b2ac-82467441c253", "value": "12:KzFEkUfEEFKNI5rEy3cKrEj+kafaE+oDI/DrHFIgnIqVedIIeIBc/wWI9KI7XU:MNIOKPkAGoUbrSgI8Ehc/Z+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022691, "uuid": "bff8be56-62c5-422f-9547-7bdfc8e1170f", "value": 943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022691, "uuid": "4483608f-25b9-4cd3-ba3a-2134bf2a5d72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022691, "uuid": "b7ea0f05-fa8e-490c-8d1e-5e9ad275f172", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7636dc-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045847, "uuid": "65234497-3d95-4b12-8586-bf5b6c8a9867", "comment": "Malware payload", "value": "e412530b8eef2c02bdf57a1f03dfd60b", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045847, "uuid": "15fc9c4b-af31-42e4-b813-ed1eede9259a", "comment": "Malware payload", "value": "24e8c437fd971140b5b616acea1102572d00688d6590caa0d8a335ee4d2189f4", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045847, "uuid": "d7869de8-a0b2-4b94-b529-dfcf39e091b3", "comment": "Malware payload", "value": "6d0747469c6b2fc1f43d62b14a3de6c6084474fc", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045847, "uuid": "0790756d-d023-45be-b224-6f2e614eb5b9", "comment": "Malware payload", "value": "c593449877ebe6b611e0cb13d1c89c01b7e4f16e56226709404434a593467fa54767f9f1354e81fad60bd030e3b7a1e9", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045847, "uuid": "9dcfc3bc-4a8d-430b-8987-e5e9098e655f", "value": "T15BB633BD89313CB2C6DEF872A0675D287CC8041765AED0FA3B7A36559B477907233A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045847, "uuid": "ba66ff01-c2fd-4275-89e7-415aedb87ceb", "value": "196608:kOVOdlFnsuc6Dnxi/PEkloEePBtKriRbJdDHQZxP3bpoKFZbx:5VOdzsucm3Ge2rKq5rp5n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045847, "uuid": "340af058-44a8-43fc-ba20-25d5a84c1920", "value": 11243352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045847, "uuid": "5fe7dce9-fabc-468a-bf60-c710e438b1b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045847, "uuid": "0e9ce7e3-b8d1-4d0b-a542-8eb84aa98e77", "value": "2oxfordmobilexray.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e476878c-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057505, "uuid": "c78cc667-ee33-48db-8cca-0273bf3a4f6c", "comment": "Malware payload", "value": "37d5896a9382342c64c47762cde1b596", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057505, "uuid": "1aec508e-5936-4c49-af6f-9983f447950f", "comment": "Malware payload", "value": "2501b2818fc37167382adc0954736bc52b8582979789a865e5e96a3fca832da1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057505, "uuid": "df00b14d-acc5-46f5-bc1b-4e9df8fa8039", "comment": "Malware payload", "value": "373d63e7f8d925af4ddb511f250c814aeb5b45ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057505, "uuid": "e5a5dcd4-bb36-4c88-a288-341b026531a2", "comment": "Malware payload", "value": "2c732ee56f3146d4d4ac67ea0105ad3657c30f14eafdcc7c5bca7cd6dcf225ea5a5eb71eb932837712c1cc90f6868360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057505, "uuid": "96287842-e1e6-4e88-9672-39d47d4f5eb8", "value": "T1B254D004DBE90008FAE11F99EDBE19000DAEFFAB5E1EC9EC21584D5D453994A9CF2736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057505, "uuid": "4db701ef-6f79-43b0-b90a-88b8c4c1574e", "value": "6144:CKaBAcuOP+hCqOWoOB71WWObvGU9xDtczIBrwOCZb5IdbwS7YIOoh:2uZhFp1J+P9BrwfZbmdbwoOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057505, "uuid": "30657821-25f3-4508-8d0b-f56ffd012602", "value": 283240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057505, "uuid": "77b9b54c-320d-4d4a-80f2-d7c5649fb32d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057505, "uuid": "7b67b293-3169-4191-a3f0-854fcb0383e6", "value": "Advance_Payment_Receipt_PO-EUF-2026-011.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07403e40-2de1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775057993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057993, "uuid": "645b4376-c2ee-4993-a2ae-2b79d33dc7c2", "comment": "Malware payload (Formbook)", "value": "e85e3bd072750e4a377e28ffdf6dc51c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057993, "uuid": "c6d484fd-cdce-4ce9-9e0b-21cec718d902", "comment": "Malware payload (Formbook)", "value": "26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057993, "uuid": "e99e6c9f-77a2-4186-be79-5a0b254b5ab3", "comment": "Malware payload (Formbook)", "value": "c71fb6b0047634dbb990530724da11f7c9195d97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057993, "uuid": "53fbdb02-aacf-4c5a-ab38-bbf13e0737ca", "comment": "Malware payload (Formbook)", "value": "6d8b413eeaa3595740467649b95b2a29f37872deeca7606add6e49bb4e774c3929cccfd14c9813ac82417e8b8dd99a72", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057993, "uuid": "7e5c2f78-4133-4c00-ab05-4670406a9db0", "value": "T179C60614D26C94BE82DEDB4CD5B1D1D05D8D20A9A98DDB1E302F91783E05FA3AB864CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057993, "uuid": "8edf9f6b-4007-479d-b664-6e973d533e0c", "value": "196608:spp/JMux+bEOoIAuvAmFQPIgcNa0j33U5iSNrINdNwfvbQxss+uunsvZbZMyR+Io:0Dz+bE2AzmFuIgqaO33Ud5+dOSshnYF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057993, "uuid": "b3962043-55b8-46eb-8484-5d5b6bcee2b0", "value": 12316341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057993, "uuid": "3a5e04d4-fc6e-43cf-95c2-f11053bc3c2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057993, "uuid": "bd01cd21-ce3a-4888-ab6d-847c7a07aeb7", "value": "EURO9083783783.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea0811b-2d96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026196, "uuid": "f0d59a4e-4baf-445e-971a-e9e47fd17102", "comment": "Malware payload", "value": "cd2175cb5874abc9726410d985eaa174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026196, "uuid": "09126333-1f1e-400f-b123-e1b11cb8fe9f", "comment": "Malware payload", "value": "27543ca8ae97ed1ecbac47e42919d06b2c5981c51fff9e06f041f0dbd800521f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026196, "uuid": "2921deaa-ffa2-43cc-a907-7ed5015e7b3d", "comment": "Malware payload", "value": "5f891af833d95769adb65eb812f531cf0152176a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026196, "uuid": "d741219b-19b4-4f38-a1af-1daa259a1c77", "comment": "Malware payload", "value": "ee38d8f4898051bcbc1af12b3fca925630de004d18877c88cf35c0e369526f437a1258cbdbbb6877f3d08ec981d16297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026196, "uuid": "866a98fa-fffb-4d26-a954-948740e7509b", "value": "T1D2A68D03EC9515A9C1EAA231C9B69253BA717C495B3263C72F90F3382F73BD46AB4750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026196, "uuid": "b4d37c8c-2033-455c-bdb1-1b18cc48f606", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026196, "uuid": "76b58c0e-7c6f-44d5-9290-7be20fec1c2f", "value": "98304:pZ0mo6HTf1YzCVF/8kOKEYGlqFe2ayq3uc/ytGrGdBd5Y2weB:pZxz9YzSeXflaq3ucKtWG1q/eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026196, "uuid": "3b386107-d210-4bcf-9c68-a74322437de7", "value": 9640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026196, "uuid": "0061f657-6cd9-4fd4-b8c4-f5250ce67fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026196, "uuid": "47a6e944-bddc-4a9f-b394-2475662b6758", "value": "osamabinladenclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc594c50-2dd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775051452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051452, "uuid": "0df4a274-eb28-498d-a8e4-59a47036bef0", "comment": "Malware payload", "value": "201f8e9f41746b37abd615ab44f21b9a", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051452, "uuid": "0db0bad2-f5a7-4f27-b797-4663aae8326a", "comment": "Malware payload", "value": "27cc24191592acbbb4108f1f947de3458922bd3212f0cd8d10b01e0f0f432f75", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051452, "uuid": "107536fb-e4c4-47da-8915-1f7ed6c67cda", "comment": "Malware payload", "value": "b922dfc1281f7e01f924701eead489622df0a406", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051452, "uuid": "9e627eb6-894f-4ed1-99f2-1c8307d3989e", "comment": "Malware payload", "value": "946d3b5360a341362caf8dd27f0fc9706b657b864a461a5eb11cdb4c52c702193d76c329030dd1d57a39ff4fa547ebae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051452, "uuid": "e8247214-4e97-454d-bc03-ef72cde29813", "value": "T1F584FFB59863DF84CA2597AE4465F48D6422F1983CF724F6C66F7E7EC037E20E826508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051452, "uuid": "aca86936-4350-49f8-a1dc-f50beed0cca2", "value": "768:j5uQnKj+s/H99pKRycoHJreODGOY5ZnreO2FsFSFJreOa9OY5ZnreOU7OY5ZnreS:j5cqbyb0fAtvPnNWkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775051452, "uuid": "0b8845cb-d35b-4cc3-a253-4f385d08cd43", "value": 391677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775051452, "uuid": "48f56cd7-2ecc-49fd-8cfe-3fa7e1c42448", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051452, "uuid": "1bf2b046-0df9-4ae1-8698-38ca26d3df97", "value": "\u041f\u0435\u0440\u0435\u0433\u043e\u0432\u043e\u0440\u043d\u0430\u044f_\u0442\u0430\u0431\u043b\u0438\u0446\u0430_\u043d\u0430_\u0430\u043f\u0440\u0435\u043b\u044c_\u043c\u0435\u0441\u044f\u0446_2026_!!!!!!.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923f77b6-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045771, "uuid": "f2d353eb-2021-4125-b30d-8b4aeb1147cf", "comment": "Malware payload", "value": "42ee93814e13b6e082f9a321225e3a56", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045771, "uuid": "24a03fc0-0845-4e64-8309-3282da617220", "comment": "Malware payload", "value": "283a63c497522046fd0654e224dc322143f7d4e975d5e437105d65c40424d7d2", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045771, "uuid": "361f840b-e382-4cbb-8383-54d9a341654d", "comment": "Malware payload", "value": "e3c5e3792720fcadf2cf235add563e15e3babc34", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045771, "uuid": "8e93f3b5-2597-4db5-b411-952fc1c416ff", "comment": "Malware payload", "value": "01f765a724c40b69b337004a4c0b1bab896587248f4ed881889fdbcac64c4eb54b22c27fe925a8b1f3fafb2bdf2bad05", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045771, "uuid": "e5eaa330-c05d-43af-b3b9-55e71d747508", "value": "T1D13357F2843A45AC09E3F193AB5A56DBAF45E7163ED47434F98C0271D19AF2CC428F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045771, "uuid": "ba7324c3-60f2-4875-9264-6b37ad5afd06", "value": "1536:jcohCfM3lg7d+4Yu7M5HPN/UNIiWHd7z82+LdBa2K:jcohyoK7d+Ru7mvN/UNIiWHdXEHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045771, "uuid": "28762515-d1e4-4b5d-8c60-8c9c76d061f2", "value": 54133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045771, "uuid": "45f606fe-8086-4ec2-98a4-8654cba9f34b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045771, "uuid": "545f7181-88a7-425f-8881-a8f99902828f", "value": "s.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e833d6a-2d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775015297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015297, "uuid": "c8700cbd-af6b-493e-8864-28d09b1926b8", "comment": "Malware payload (Mirai)", "value": "d0ce8365a4d93335e193ac1323145942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015297, "uuid": "f540842d-08a0-40ff-acd3-699a1fb451e5", "comment": "Malware payload (Mirai)", "value": "28692d0e3057eb08da2feaf236f7fc0e4f584ef6a0ebc5b6bd30989c08e13971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015297, "uuid": "46f36855-69bd-4658-8213-33e8006c4e2b", "comment": "Malware payload (Mirai)", "value": "bbfa8a21fde8d044397fbf82f7fc7c5314e05cf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015297, "uuid": "ed8c4215-1d99-4652-a5ca-d4112d4e442b", "comment": "Malware payload (Mirai)", "value": "c6b5cc62e683f45437b25264ab63262c21e7d67f186475ef59b0591e79eb20fb0e86bf9f77e557915196b1ac6f9e401b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015297, "uuid": "5241d5e0-fa6c-4872-947b-bfa661080e27", "value": "T19024C71E2E228F7EF269C73447B78E34975932D623E1D685E1ACD1115E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015297, "uuid": "5c9e0aaa-8e73-47a7-b5c8-6d6b7678077b", "value": "6144:TP1mWoBrXJywdy1qVlhxcPMGY4wuUgN8m:TPXcJywU12xcUzgNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775015297, "uuid": "7e14c85e-0577-4609-985e-30aa3f6b35cf", "value": 226776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775015297, "uuid": "0c9bdb87-d696-4bf5-b1be-549e3f8d7e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015297, "uuid": "5651c87c-6f63-414b-be5a-5013d3cc2a1f", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0b6b0f-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053599, "uuid": "e062054d-ab5f-44e8-a33f-b390adb7ed31", "comment": "Malware payload", "value": "bfc9e3901c8eb02bacf2e65ec81ea550", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053599, "uuid": "6d0dbbf8-b86a-4673-9f2b-c5e3d1ff61ea", "comment": "Malware payload", "value": "289a7246c9c1386f4e23506a730ac1eb1d77833be20c46506996849c6605365f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053599, "uuid": "f6a7a524-e050-4f7c-aa3c-183d8b7e0024", "comment": "Malware payload", "value": "89c22275b74bbf8d0b60702276ade2176cfee3b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053599, "uuid": "94f07d74-acdb-4ba9-8c75-ab7d34efb25b", "comment": "Malware payload", "value": "9814715908bcce81cabb86ef3c87f67ad1c5fdc1320801dbf22ee4d811dadc18397b521a1a91dec5aef47f188b693883", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053599, "uuid": "45bab56a-9e50-4657-ad40-0b0d41805378", "value": "T132B511E0D3DF396E5855C2C92CEA1CE0DCE1785C2484AC97EA6D547807E1BAFF8294B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053599, "uuid": "05d1705b-122d-4392-a711-778f2edd86cd", "value": "3072:f22222222222222222222222222222222222222222222222222222222222222C:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053599, "uuid": "9e64e34c-94ca-4c90-a5ba-292526c28b30", "value": 2309250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053599, "uuid": "b43cd4e6-ffe9-4c89-bf6e-b6a47a1a5ad3", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053599, "uuid": "f3c408e5-1719-455d-a448-a6c8d2e3af55", "value": "DR0297 MANDEL.....js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6615f819-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064165, "uuid": "591f979c-3854-40f6-95a5-df1c866553bb", "comment": "Malware payload", "value": "7760960d1284c167174465e92da4b9b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064165, "uuid": "4233f312-470f-4af3-bf3b-fee5f9711f0b", "comment": "Malware payload", "value": "2927bd11ed8d3fbadf7cb3960edf1cd30d1cf515853cb9c0fcad42fabce745d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064165, "uuid": "45aecf46-bc1f-4841-9e49-ea38462e17b3", "comment": "Malware payload", "value": "a45730bc3a7c4204abbb64630c0662ccd2966fe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064165, "uuid": "a865399b-bae1-4df7-9c27-c87e1a94397e", "comment": "Malware payload", "value": "92d6af5bd3fec04383d735b64b06001d66d430db9bf097992719dc2dec85f7cda35e031da8255e8fd2eb4f19dcfb350f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064165, "uuid": "a26b74b1-bdde-41a5-87dd-da710f54182e", "value": "T1056342DF3FE1989232D4770359E71A2179000CAD75FAEC904C0EE6BA9AC3E11B559DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064165, "uuid": "4bf44331-e3cb-4294-87d3-1323919dfeb0", "value": "768:2RYalP2VEv0Vty22/etfhcdagg9dvrZJoFqQ:2GRVCgy22Kfud4dDAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064165, "uuid": "748cc989-cda8-4f58-a9a2-71bf0e12f918", "value": 67143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064165, "uuid": "d898bf63-8103-478e-97f9-cc239a0ba226", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064165, "uuid": "f692b7a1-9708-42be-927c-701d8b04faa6", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad0e66c-2e13-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775079877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079877, "uuid": "4aab6ff9-1395-4244-ad45-532ed16684c9", "comment": "Malware payload (LummaStealer)", "value": "65c90be7eafd1deb2568cd5e663850eb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079877, "uuid": "834af9fa-aebf-4b86-9f19-eaff62e5db49", "comment": "Malware payload (LummaStealer)", "value": "29acd740a10b820da199346a5fe627e7b48d405f10b54ab2f40c32797b14d044", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079877, "uuid": "d64ceffe-bf16-4177-8a27-38842d3fefd9", "comment": "Malware payload (LummaStealer)", "value": "7568b4fcd4588395801d0fe289e7b53f7cdbc62b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079877, "uuid": "cb9fda0c-039d-4b11-bc4b-e5181013cbd4", "comment": "Malware payload (LummaStealer)", "value": "694a852484f0e4052550709ed7c1f9114c95700f5b273bcf674e7e851e18738b993ce4a8d5233a3a4725696af59bdcfa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079877, "uuid": "0ca52c29-686b-42ca-99b9-13536d984d94", "value": "T16C854C40FDC288F6E416163255EB73AF6734A9090F369A83EA847A7DFA773940C36345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079877, "uuid": "e20c7b03-5abd-47f4-9c7e-376e096110e0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079877, "uuid": "8a344ced-d9a6-4605-b018-7351d0526d48", "value": "49152:E4hMWwUVGaZ8EZGjcYcMnOCRLq4wRQdncQXnmN+1KR7aJ0f54MCGkkFjiq:rwUs6zbkkRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079877, "uuid": "44b8af5b-2aa8-40e1-a17e-b80bb2a3db41", "value": 1756800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079877, "uuid": "03f8988b-396c-42e9-8c59-a609fd24602e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079877, "uuid": "36e7e8fd-fb64-4931-9ec0-9691ef9a372a", "value": "mixmain3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c4066e-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039571, "uuid": "cbee7daf-0489-4fff-bbcd-4263bce4439b", "comment": "Malware payload", "value": "f2d25c516fbee0e5fbe6401678a60c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039571, "uuid": "34aa6160-3d7c-4b6f-b2cf-fba10378cb11", "comment": "Malware payload", "value": "2ac08b5e2be289278c79ab0814a6b37d02e71a78f03c0ca144a20791f53f9b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039571, "uuid": "14020a77-226c-4c2f-85a8-041c7eec8a2c", "comment": "Malware payload", "value": "1438495503b6b1135d3f52938f336852a1ae3106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039571, "uuid": "12d3061b-d51a-474d-a115-945887216733", "comment": "Malware payload", "value": "cb8ab31ff70e5b4dfd050036791aa40022882476385a67808da3c7c363ecba88cf0da94e5214d709f261bc91db9d13f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039571, "uuid": "cb9aea7e-543e-4b79-81d6-325ebdac1b08", "value": "T195773313372160D4E497CE7E81A19655E620F9D20B706BEA07F01A532DBF3F84E7963A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039571, "uuid": "9b4f32aa-54f6-47f9-be2c-d691e973a18c", "value": "4db282a3e2c16ba2977011b0bcbbdaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039571, "uuid": "d2165719-8fa5-47a6-ae6c-022461745a98", "value": "786432:VaVM5aEZ+uV3Ipq5cALSufbEKz5J8DHbKnOLivxYqUn:VwNI3FcufbE+5J8v4JvxYqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039571, "uuid": "cf3bf0bf-bf93-4bb1-afae-5a86fb66820d", "value": 34468864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039571, "uuid": "51baba67-0d26-4887-816e-ae60e91921b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039571, "uuid": "60fdcc60-2c50-4a69-867f-048e5b02d9e4", "value": "ExSvino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb90adf-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775038593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038593, "uuid": "1bff261a-b8a5-4ad7-a54e-7029a0b8309e", "comment": "Malware payload", "value": "b61e90e47a2ce5042e43ba1d142433c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038593, "uuid": "6155334c-0474-4963-8ce7-7808dd1d123a", "comment": "Malware payload", "value": "2be661211e8a0df37f4d20ada629abe9f75787ca491382151b43520bdf3d1c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038593, "uuid": "1458a672-24b4-4450-b70a-cf2fcb908eb8", "comment": "Malware payload", "value": "ae56036b8e095ea1547d6e1d7ae9137408640a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038593, "uuid": "9c8db9c2-ef20-496e-8907-e7f7359a7165", "comment": "Malware payload", "value": "dd8ec2eaf73a6b0c8060edf66290f35411f7aa60dab9e5a905228e62feea1a982db0fe7558c113db35f2698e988470a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038593, "uuid": "799d823b-6725-4f04-a7dc-394b0a50b0f1", "value": "T1F1188C4263A609D6E9F7DA349AE65213D673BC067B3082CF324C173A1F736E04976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038593, "uuid": "a3c75d88-8429-425a-a724-09a8214b61d4", "value": "169157cfee234e9762fb7bbc5b500f73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038593, "uuid": "ffd51f2a-4ed6-47c6-9d5d-4032140e6b6e", "value": "786432:0pAhGJ5em4eckQn04nBvyPJigAr4TffTpgPVlcm+wyk:0pAc5euPQnEHf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038593, "uuid": "9a38a895-8763-47ac-86a1-58b03e7e6ff6", "value": 85661696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038593, "uuid": "6ae344d0-72e0-4443-82dd-6a899bcbe781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038593, "uuid": "b8b3703c-28d2-445a-ac48-a0c8c5a9928b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a712a6-2dd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775052676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052676, "uuid": "3133b654-c86a-450e-92a8-cb5fd52b7bd1", "comment": "Malware payload (Mirai)", "value": "222276da74b6dffcbb2726a873a3bc39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052676, "uuid": "f854c8bc-e9e2-4164-b347-ea2dded077e9", "comment": "Malware payload (Mirai)", "value": "2beb8732866cc32c95cfcd9403a82bf9c26a0370e78093932f69d74ac135599c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052676, "uuid": "bd497af1-00d2-40fa-8105-67df6d0b0adc", "comment": "Malware payload (Mirai)", "value": "7f6c8b01beb5a8c8d69a577510fcac52e35fa550", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052676, "uuid": "869be469-c2c0-4a6b-be36-4049364ea3ef", "comment": "Malware payload (Mirai)", "value": "5081796934627f0f0ee44729fcb13ccd429d14e2aa965ccbe2efc395868ad52c23e7f9bfdc09171462d08d43a771d59d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052676, "uuid": "bfd3b069-ce97-45f7-877d-b5c3092b8a1e", "value": "T12A2329035491C0FDC955C230AB3FA636C922F47E123AB59D73E0BE227E5AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052676, "uuid": "b37a1c3b-3562-4578-97c9-c01834181c6d", "value": "768:FkrR8ysZAY+OGZZRw4x7wPtKOoKvHjKRDACGyjltp4B6gC:6d8y2+OOkyQDckCGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775052676, "uuid": "54ccb39c-b985-4ce6-80ec-042140978217", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775052676, "uuid": "7e1bf523-4a3d-40ed-b474-571a48d039ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052676, "uuid": "8ab9881e-c43d-405e-83fc-e8318361340a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ceb06c-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1775050552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050552, "uuid": "e7cf0967-a23e-49f1-84e3-74fc34e481a2", "comment": "Malware payload (DattoRMM)", "value": "003a858ee0df33d2dee38458dd222a0b", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050552, "uuid": "2a4bb360-49da-424a-b201-beff6670bd47", "comment": "Malware payload (DattoRMM)", "value": "2c03a6e16e8d639ceb1642a1739d1a773da558e0e351b50873c4a0ab9e63f5c6", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050552, "uuid": "8163dcbe-94a5-466b-a0a2-d16acdc2de2d", "comment": "Malware payload (DattoRMM)", "value": "be8dcf7834430a720e6315f682422b33929cce91", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050552, "uuid": "1637acf7-2f41-45fa-88a5-a829d4816d78", "comment": "Malware payload (DattoRMM)", "value": "2b41016e015c5445cc1f2b5a54ae28ad35b896c9ee461a071c0d6ccc37185a5d784cd9c31e992d8352d1c74662758c15", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050552, "uuid": "d4e61c0e-06fd-4211-bb83-4619e2fe4b6b", "value": "T179B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050552, "uuid": "ac862ede-9032-46ed-b0b8-a95ddd4b4401", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050552, "uuid": "9a8caed1-2fd6-4221-b663-01680ad583ed", "value": "196608:UaZk+w9P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:GngmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050552, "uuid": "a42d5eb9-c7d0-4e6f-a630-4aefacafa0e9", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050552, "uuid": "fd4858d7-f3fa-41c1-8210-674289fa21d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050552, "uuid": "e0eedb02-7f31-4ed7-802e-c16abb2bff5c", "value": "Exclusive_RSVP_invite__2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e80861-2ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775056110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056110, "uuid": "5bff89da-4f76-4128-9b40-702e98d811b5", "comment": "Malware payload (Arsink)", "value": "750734d48a9a37a7e602d5e1f65dc913", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056110, "uuid": "bc3c4b1d-3c8a-408b-8efc-d5785e04d41d", "comment": "Malware payload (Arsink)", "value": "2c0bce17bc9bbfbea95e5b75e6294fd1d5205b915b24729d1f2377e2a6f2b578", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056110, "uuid": "80f1a9b3-8f20-4b60-80c8-9ad5dbcd712d", "comment": "Malware payload (Arsink)", "value": "7fa1ae6b382122d3e1c309a0f5303e6406dd6845", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056110, "uuid": "4369025a-2ac3-4c07-ae96-e4cbc15ec707", "comment": "Malware payload (Arsink)", "value": "3b940dc31240de452cccd632ed677caf0fdd9f12446cd503b10cb1b4e2d239e551cd10b2c6c25805140c044698769de3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056110, "uuid": "d2516043-b3fc-4cb4-924c-b88e3ed07c12", "value": "T104B623638D617226F0686EBBDFB656A0F6006B61DE9698C270552F33E137932B3F41C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056110, "uuid": "4789141e-c067-445a-8e44-e0bce0027877", "value": "196608:kS45w/L7DvB+o2+rh6hBvswN+PRQjN+aDj0cp+lml2wLj:kDqj7DvkoO3+x60cgmtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056110, "uuid": "3a400592-a7ce-44c9-b816-bcd67ef30295", "value": 10675170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056110, "uuid": "402e156f-78e2-4cfe-95e7-810b27f5da78", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056110, "uuid": "6cd6f12b-c19f-4e4f-8507-045596ccf422", "value": "base (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14715133-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080779, "uuid": "162fde7c-e955-4745-ad28-80ada85f4bc4", "comment": "Malware payload (Mirai)", "value": "c14888670d249ebae909e7f76e28ab33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080779, "uuid": "050d168c-1148-46d0-b17e-0972485486ef", "comment": "Malware payload (Mirai)", "value": "2c5d22782f78bdb3485b731af0d86dd3293b7be959be1b964577fa0fecdcaecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080779, "uuid": "426a983d-bfc7-4a53-b7d6-b6d4f022e658", "comment": "Malware payload (Mirai)", "value": "67e8e99ab8dd95900fa93f90c6211584cded9e51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080779, "uuid": "4a935399-bceb-4d90-8841-e1bc6a2802bf", "comment": "Malware payload (Mirai)", "value": "b2a398a037d8b84a0daf0f9c1acde8a5a6cd45abc4c6b66a3e859ea2372f3b6a1f6098dbcd77f371d8fdbea49d8c370d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080779, "uuid": "5f5a440b-fcb4-4f3a-8ad3-6586a3366d40", "value": "T1F2E2182BF0858695C083017094E74C361F17E5C18B585E7F6EE88592188BB6E7F27F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080779, "uuid": "bec8c39d-2701-4fd2-b579-4d19e185b852", "value": "768:ZdKhKbT7ekuBYyBeh8moL4AQn4OICnw7:EK3Ra/LmoEAQ4jx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080779, "uuid": "a5fd76c4-9705-4f9e-90cb-0ba3ac777393", "value": 33116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080779, "uuid": "a1526fab-18ec-44ee-a35c-4dd4212c793e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080779, "uuid": "eb006816-b262-4b74-8791-b9e729a6d226", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db615aa-2dc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775044824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044824, "uuid": "05259f89-8db3-42c1-b542-822e71d9989f", "comment": "Malware payload", "value": "bae00642c809512d5a349c95ea7e9d35", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044824, "uuid": "88934931-fdf7-4472-b466-d7f77e53ebc3", "comment": "Malware payload", "value": "2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044824, "uuid": "ef0268af-96aa-4e5a-9efe-70592e679f36", "comment": "Malware payload", "value": "622efd2e6ff1dd652ace557a370b35376ebb025c", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044824, "uuid": "fac017a4-3ebf-4455-9d1c-e419298e8167", "comment": "Malware payload", "value": "323c39feb7bee700a059f28e1dd463962044ce3045be5283800bb7308ef804a5670800a1af391f8b6876ee513feff843", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044824, "uuid": "f2bf756b-f00f-4b96-a4e1-5df83686d41e", "value": "T188D4EDAF6F10E2E1D9D96AFC97816D0583A0BDA375D0429E5186FB1FCE34AC38E9C144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044824, "uuid": "f37cfe37-156b-4285-9d2c-392b7925e2a8", "value": "6144:UXiZZeaRYZjGcVVwi1YzkG352ocks2suVrddFfPR03:Ujayl835zckHZrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775044824, "uuid": "1ad1174d-9928-4519-a0f0-d03d45ed9871", "value": 616504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775044824, "uuid": "e9b90bbe-65cc-416d-b83a-7780632dcf04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044824, "uuid": "f6e36d80-3710-43d2-8d35-c910e18f5e5d", "value": "Veritaseum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be4eb9a-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080764, "uuid": "f16ef35c-d2d1-4839-ad87-9e5c655037d7", "comment": "Malware payload (Mirai)", "value": "8429a677d98d3083a109e09e451c5221", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080764, "uuid": "066aafe9-f8fd-447a-b777-e4f946bf9246", "comment": "Malware payload (Mirai)", "value": "2d723884150a72b585208c5a84677280d65e35c30f96d84efcb14b74b4c0bfb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080764, "uuid": "54c3d3c6-928a-4330-b2b3-48436d313add", "comment": "Malware payload (Mirai)", "value": "ec53dd106a118ddfe4d0f14eaa2794672031da3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080764, "uuid": "5bb8b906-f49d-4e96-9453-93d85eb54c11", "comment": "Malware payload (Mirai)", "value": "5826154f92922ed5d7ab8811d6e1ce03b12f43a91f45f2cc939b02e5b530674eea4a64c11e4981218bab2e2702ac15f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080764, "uuid": "2e5bafdf-d570-4ce5-8392-70c4a8b59bd3", "value": "T15A134A95F083C8F2D94A0470B063D73B3D34E4C5621EEA97A66CD771F8D2B826517EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080764, "uuid": "70a20a62-fbf8-426e-af0e-6ee60a2f22c8", "value": "768:CNDFBueXuDgwOJt5vPjelk1ry/65iZIG+jU9VOhNfpsCd7mlsn:Cj5Xl1Jt5Hjeu1ry/60ZIG+I9gNfeCdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080764, "uuid": "c5c23a8e-b435-436e-8b2e-f1d425b9bb31", "value": 42480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080764, "uuid": "dca77b74-543b-48a1-a576-0c3bbc2847a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080764, "uuid": "cb5cab47-5a55-4f43-acb4-3b9ff4593dcd", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71757ff0-2d8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022953, "uuid": "6d7101d1-2c86-4f19-8849-fb6b544c6903", "comment": "Malware payload", "value": "0ad53b1efcf4e55aeacbfbaa0ace0f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022953, "uuid": "b896e593-12f8-4dcb-8ad0-7510d7b8ab66", "comment": "Malware payload", "value": "2e8b5760275176c4f103de5d69f3099c190f08903dbbebe7d8d81c93fd7946af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022953, "uuid": "e1dfd2eb-c5f7-4ef7-8f71-223c14e358cb", "comment": "Malware payload", "value": "a138c5e96590f2f51638512359177bd18e8427ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022953, "uuid": "b217374c-a4fe-4cd7-b96b-f51d232fb0dc", "comment": "Malware payload", "value": "806a3db284b216c66bcd9a50f77cddc803f07990b618937595ed91cff7bbf09d0d01d0f56078f3831cb3eeb4dcb46e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022953, "uuid": "d0fe5eb5-ad00-42fa-8e65-b760774a730c", "value": "T1DAD3F19BD44C579EF2A82AFB0C5F3C9143AC4F6F88598DAA466046DA7F606DC441F8F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022953, "uuid": "7e4e218f-16e3-41d4-96d4-4c97d1b50872", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022953, "uuid": "dc6cd559-2294-4860-8acd-6daca37f8df6", "value": "3072:jPLOiHwWhcqHwpxu/vzrGsWU7JwxdqnDMj6ApDN3CjQ:j6iQ8cqQcvzZVwYYph3CjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022953, "uuid": "4609e815-f485-4026-b980-6dfd007909f7", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022953, "uuid": "56f726a8-4be0-4ca7-9c6b-719323394dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022953, "uuid": "6095dad0-15d2-44e9-8382-e13b7665b5a7", "value": "0ad53b1efcf4e55aeacbfbaa0ace0f68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf24cea-2d9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775029386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775029386, "uuid": "822e1810-f53e-45b3-88fb-1dee1d976ebb", "comment": "Malware payload", "value": "87cb598c63dae297b9bf9ee7fb668d5e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775029386, "uuid": "ef2d8d54-a97a-4744-9eb2-384ae8647f51", "comment": "Malware payload", "value": "2f4f33b25613b5546d1e80eafece527dd1c6ea626a0e3b9b9fa6ee1be0b78808", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775029386, "uuid": "6cd95455-9541-4406-be3f-d3a45a770b72", "comment": "Malware payload", "value": "ef08862acc8b46946bc02f0e32049bd7cb1b2986", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775029386, "uuid": "f9c6fb9c-18db-49ad-9fd9-f635f79050cc", "comment": "Malware payload", "value": "17a6bfe6034882114ef9b05fb9f2cfbd323eeaf60c0aa32a70da7b7ffd75e3603a4c28facd311e3318c058e6fd33bf4b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775029386, "uuid": "b4b08d43-7b0e-40c5-a841-c0a6f6f70abd", "value": "T1E981D31A8308B39F7733A7E3F329168239692FF9BF75A29C884D90006D442978195CDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775029386, "uuid": "17954a80-2d08-42db-aa01-d86202198e82", "value": "48:MxmTINrnZNp+mD/i8KWCFjGAi6c3WG3Wr3Wo3Wv3Wrod3xNWVLbv2UwhIcTP57GR:Mx8I1jG2HG/v2VacTB7+tct2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775029386, "uuid": "4f4e74b5-43ee-4f6e-954b-c5d96e047659", "value": 3826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775029386, "uuid": "351f0b77-1bc9-476a-ba99-d2c20f7dda77", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775029386, "uuid": "3fcfd582-8b16-4259-a48c-2932b161a7aa", "value": "123f3asd32.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80f02e4-2d84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775018427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018427, "uuid": "125bd46a-a2b4-4137-b564-ad5677ca1100", "comment": "Malware payload", "value": "bd078f36e1630254a6d03b7e09ee95f2", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "protected", "colour": "#5883FF", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018427, "uuid": "5d9ccf62-f1c3-4dfd-afed-f8b3a10237dd", "comment": "Malware payload", "value": "2f515997ab1c7f5ab94a46041ad2af06031a842469b65bcbd2c64bd47f12a896", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "protected", "colour": "#5883FF", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018427, "uuid": "d7a001a1-2a5b-4aad-acfc-280b2663c940", "comment": "Malware payload", "value": "243262266b1227f4f674786c17c3130d74ef5a6c", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "protected", "colour": "#5883FF", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018427, "uuid": "d1711ba5-276f-495f-abbe-1a654f12323c", "comment": "Malware payload", "value": "a7dd165b64ddcd782ddb11245e99acae23ccadcf8ec69ccd5c05b144a21209d9e0c81b824b21a46798e5ac944b927b26", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "protected", "colour": "#5883FF", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018427, "uuid": "542abb58-ddfd-4024-9b71-ed298fc3d28c", "value": "T13B539510994840A486764EC3CD68C66687D7704AE0067F2670AE78E86F1FF74D672F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018427, "uuid": "0378d065-97d2-4cc7-92ce-dc699bee6449", "value": "768:4NQCofGumc59DbkwFFFFFpoFH5H5dFFJ5rgDCREFFAFFHbFpFBbdWFFF+rAFFFFM:4NofGwol3hWabKSVWPIe0dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775018427, "uuid": "9b4192a6-02f8-47d1-8611-3df6e52f6c1a", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775018427, "uuid": "b2395a9f-4522-4415-a634-99933dcfa602", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018427, "uuid": "779b7952-a9b1-4df8-8972-c81d1c2c553d", "value": "Protected.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a4fea7-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775045822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045822, "uuid": "9d155e90-3df6-4025-b695-8ff3ecb1e152", "comment": "Malware payload (Vidar)", "value": "62dadcb13cbdbbc9b3b483ef403778bf", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045822, "uuid": "5bf75754-aaed-4acc-bd8f-8145ba685471", "comment": "Malware payload (Vidar)", "value": "2f97b6f7fed27696ecbdd715219740a2a4ae7c746a485ff7469b8da9bc035fe1", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045822, "uuid": "03a61128-d8f0-4cb3-8d6e-9590ca99d26e", "comment": "Malware payload (Vidar)", "value": "7f88d13c7361dba745d2a00959e05b46ff1a0c87", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045822, "uuid": "e6dc1215-1c16-47c8-a429-dbccdff19c19", "comment": "Malware payload (Vidar)", "value": "b817a076c45fcbe12b87a083b5bdf1a99bc7fa5bc1c6e94c229b7c9c01aad860531ac57704a5387465d5e35866f9d6e2", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045822, "uuid": "eaa354a9-a4cc-4b41-8193-d2864baa5a1d", "value": "T182C73354FBC9608BE55FEEF394AAA35CA5A2E2019730E9AF557860113C42BF7470BC07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045822, "uuid": "38fd4b22-b20f-42c5-abb4-e0554962c988", "value": "1572864:HrXUMwg0TsZzz8AqFrtRhThmO0VITz8VGMMd:HoI0TstYAqF1kO0G8LMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045822, "uuid": "0ee5b49f-3e52-4e98-866a-09490e7f0a3c", "value": 52835256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045822, "uuid": "4dd371c2-078a-43d3-8b2a-dac1ede80df5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045822, "uuid": "323244e0-a4bd-42df-81c1-e65bb15b48a6", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154530ec-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057587, "uuid": "71d88a3c-1ac4-4402-a3c4-9d782d7efa0c", "comment": "Malware payload (AgentTesla)", "value": "b4376f3bc76f9d0382a10cae72a5399d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057587, "uuid": "5041fda3-f07c-4194-a496-ee9e8ce1e5b1", "comment": "Malware payload (AgentTesla)", "value": "2fc594cd74b90eff0f464d7beddde8f8bc9663ccdab842db3b11fabda28b04bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057587, "uuid": "c5243901-faeb-425c-99c8-32369ffaee94", "comment": "Malware payload (AgentTesla)", "value": "34a5b468fa207ff05ad09841488336a45870ef78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057587, "uuid": "8478f590-7ccc-4c13-988b-d7328a93ca0a", "comment": "Malware payload (AgentTesla)", "value": "01ab9a2165942ed33bec01c3983adcf04b82d9dea70294f5fbd76462a11d2d4fa63eb73732f57a8a85d3898007aa6c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057587, "uuid": "c2a965f6-ddad-430f-89ad-c6ee1b275b4c", "value": "T14A65025289C42FB9DFAC5A1950FE160D93F00ACB8426798AFB33BD47BFEB544111B189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057587, "uuid": "d1902f1d-427e-43cf-88ea-14d27af8868b", "value": "24576:oO6TUCdOlbRTJAIlRXUVwlSolT/8gXptvKOx25Lq2+pLPWvlArg:HflbRBw4NFH5W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057587, "uuid": "b6da3390-725d-4ea3-b05b-334119ce4649", "value": 1455345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057587, "uuid": "eff0ecc1-4516-4286-ac12-da437a297944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057587, "uuid": "7bcafebe-414c-4f8c-9c39-b5afc942dd7e", "value": "PO G2605-3445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64414e04-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775035815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035815, "uuid": "1f794054-e96f-4d86-9d76-e3afd2f9caa5", "comment": "Malware payload (OffLoader)", "value": "954b6a928bfecfb011f534f35a8ee415", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "pw-ebsqeobzwzorqapepmqadkhvxfpcwo", "colour": "#55D318", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035815, "uuid": "36b7238f-92b7-45c0-984f-c652828ab852", "comment": "Malware payload (OffLoader)", "value": "3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "pw-ebsqeobzwzorqapepmqadkhvxfpcwo", "colour": "#55D318", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035815, "uuid": "e0e94341-30a1-44b7-9c8a-3f44a6d82243", "comment": "Malware payload (OffLoader)", "value": "5751f5b13bf89bbaac742ab7f071ba2327788d46", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "pw-ebsqeobzwzorqapepmqadkhvxfpcwo", "colour": "#55D318", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035815, "uuid": "6a52428d-cb11-4267-a479-7d4b83058157", "comment": "Malware payload (OffLoader)", "value": "b4ec5cc225e8f956e8aa0f558637bffc80cb5c1b7b2cf114d2fb4df64591215b5ed2d8a27b9ca039825567be7c982762", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "pw-ebsqeobzwzorqapepmqadkhvxfpcwo", "colour": "#55D318", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035815, "uuid": "feb61110-6e90-464b-9fff-3676c22d5234", "value": "T1DD85CF23F2CBE03EE05E0B3B05B2A15494FB6A616522AD5796ECB4ECCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035815, "uuid": "4e715f52-d6f9-4ab7-90d7-794feff65888", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035815, "uuid": "443262df-8e9a-4363-802f-f9faf0877b2d", "value": "24576:HawwKusHwEwSDMn6xcidUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71Z:XwREDDM4dHeMxWrP+beY7UY71Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035815, "uuid": "bf5ac042-9e7a-481a-bc7c-667728b0fc50", "value": 1806180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035815, "uuid": "4abc6113-a06a-445f-a5bf-02e666a06064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035815, "uuid": "72163c25-0fff-4f9f-ae05-17816dfd4424", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0e2581-2dfe-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775070730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070730, "uuid": "602d0697-078f-4654-b41a-71927cb73183", "comment": "Malware payload (SalatStealer)", "value": "6ad51700e563d51abe7b6f0297ef98c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070730, "uuid": "55a37274-5103-47d3-8ff1-2b291ebe644e", "comment": "Malware payload (SalatStealer)", "value": "305e45b1f8d4ba12e5b6942fa95af69a91e0084deecdf34bd29840559afda1dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070730, "uuid": "6c765065-e32e-4dd8-89aa-1d732ce6f8ba", "comment": "Malware payload (SalatStealer)", "value": "0c911c04e9823a7d2fac7ff25b2845b682856326", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070730, "uuid": "e8fd53b1-ba35-4866-b1b1-35a0de50156a", "comment": "Malware payload (SalatStealer)", "value": "1f11074d6cf31838fc62a305d1ebd7ae3af9a8b02784731f7cd51011c2588e70ededd33cacca7c7f8f6fb9d18f378b3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070730, "uuid": "c89a89f2-0f5f-4fe1-954f-bfa8f6763ef0", "value": "T1BFF533C6FA57862DECFFF1B6921A222184D886FCB68D0D175E6063F64265212F4CDC47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070730, "uuid": "aeeb2104-9dd9-40f6-9956-4a69e1be56d6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070730, "uuid": "8b461a8f-8143-446f-8b4b-80e70e7e9a2e", "value": "98304:1wxswoMQYH0ETIOE5IS6EG78tLv4RLbDbR6Qg:1UQYH0ETIv5I7EV4RLbDF6Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775070730, "uuid": "6f282934-ee4e-41d7-a2b8-e544f79be85b", "value": 3592704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775070730, "uuid": "f964dbba-0968-44e5-aec3-a79ab907b6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070730, "uuid": "6161337f-817e-4e40-8785-bbbb3d05b802", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cda83e-2dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775044108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044108, "uuid": "31643330-9374-41f6-9add-81067e4552cf", "comment": "Malware payload (RemcosRAT)", "value": "aad2a67141ab0e479ac9074eb6e5ae22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044108, "uuid": "7d82fd4c-de39-4b9f-afce-878ffb92132d", "comment": "Malware payload (RemcosRAT)", "value": "30bb939fad6a6fcb35f509012cdd40a9b5b1a600566a270c9627a02a72b96d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044108, "uuid": "004037bf-b0ce-4915-bdf2-96617d856e39", "comment": "Malware payload (RemcosRAT)", "value": "74eb3021136d21d95c8b2c493e1f6e4d4bb5a288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044108, "uuid": "4eb3004f-3d2e-4ec0-b6d4-b8c771f10b08", "comment": "Malware payload (RemcosRAT)", "value": "129dc8185c7c84db15c1308389aec53ac6dc6cdb776e37a6ac5345647cd326447bcceeb802f07cada4b92d157f47cb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044108, "uuid": "7f56aa48-f1c2-4bb2-8996-77bf585f2a27", "value": "T1F5551258231AD803D9922FF419B0D7B44AB85ED56422E307DEFB7EDBBE393416805386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044108, "uuid": "c3d127ed-416e-4f47-ad37-647826951c03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044108, "uuid": "13c64702-349c-4386-839a-02e1b43880b7", "value": "24576:WSJJSHwGhGJmDsO+0y0vtGdTuhJ/bhysdEd/mGoO1LTmJNrHrjf9:WqUwuQB0vwqTDhysamGoO1Pyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775044108, "uuid": "250d2689-3227-44af-b91a-ddac6a83f31a", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775044108, "uuid": "f423c922-2a59-4066-b966-11f61a5b3803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044108, "uuid": "6b2cf5aa-3357-436c-b9fd-86f3a2d7e793", "value": "ISF CT-262-0326 CFS.xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3399442-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053611, "uuid": "fe6efba9-1156-4212-bfec-9a4d31f3ee0c", "comment": "Malware payload", "value": "8ee149b9ad35d1e69e5ff4d46385a77e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053611, "uuid": "2abe8f2c-39cc-4eb5-ab69-ba132eff6a48", "comment": "Malware payload", "value": "31796e75e7e3fe1e701c8e010360e161f95a3029b22c37c1466ac04b813d0d0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053611, "uuid": "080341e4-d8f4-43dc-892e-df727ac466b5", "comment": "Malware payload", "value": "7f9aa43852af7dfdab05679072c121b750f36b3f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053611, "uuid": "8e8ca230-6748-47f7-9726-6ac0b22ea05c", "comment": "Malware payload", "value": "706bf0530a7c75fc7cd2d9cd8b18fd29df7924a8091a2ae26e8f3a0869df75979e0bc79a6339975f4dd03c1b611b2fb4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053611, "uuid": "9791bd13-6526-4a6d-b345-a340ae88afa2", "value": "T1CEB5226B71B47418C38618747B0E7BC5051DE28FF81BE45FB72B42C6B19B298AD88D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053611, "uuid": "c42caae8-e95f-491d-a228-9806eda67458", "value": "192:INWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWNWA:rLOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053611, "uuid": "1d10342a-c32a-4506-be95-2a6830957966", "value": 2337738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053611, "uuid": "a7bda6a0-05bb-457b-9fe8-51f64ebcd9b2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053611, "uuid": "3214c47b-4b1e-4b1f-8dcb-1f93787ec463", "value": "NEW ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbabb67-2e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775083209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083209, "uuid": "e65609bd-655f-4a89-bd7c-10d3f00ed729", "comment": "Malware payload (Mirai)", "value": "627d9d8e225edd9a5c0c9ca766139d22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083209, "uuid": "b5e27251-9b0c-4f51-8e1a-80021b71b8f9", "comment": "Malware payload (Mirai)", "value": "31bbaf8e9b18430b56dfc9b8a10f9b5427f012db15ace92b4381b82513efb68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083209, "uuid": "2061d4c1-9c97-4377-a93f-9aff87d52ae5", "comment": "Malware payload (Mirai)", "value": "51a91f4ebb7c1916a3e8b3414f322b2176648805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083209, "uuid": "b99ecabd-d982-49ee-b2a8-d4d82b2a662a", "comment": "Malware payload (Mirai)", "value": "20def14f9ba6077d1243e931140ca333123772fefd607e20c3a0e47032666996e86b33ac96129cb7ff4c7ae83eb6be5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083209, "uuid": "14ecba95-9d86-4c63-adcc-80140a04a3c2", "value": "T1A7F2F890B9420A27C5D5227AB76E5BCD37B067E9D2CFB303D8205B757A85A0B0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083209, "uuid": "95053dea-d98e-41a4-bb84-5f77f03a6044", "value": "768:jHnryfqG8moTeb0hcLFSx0BxmjqdIYy6y4gbAw7:jHn/PNTeycLZxWIIYy647", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083209, "uuid": "b2eec63b-0fe7-4a86-b53e-a2859ebe278e", "value": 34564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083209, "uuid": "9148e87a-da84-48c9-a6a1-27dd50e36036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083209, "uuid": "fe450435-2a90-476b-b155-7d3cf297c204", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b6b87b-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (MetaStealer)", "timestamp": 1775057502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057502, "uuid": "eb5677cb-49a4-4db9-99e1-31cde56014b7", "comment": "Malware payload (MetaStealer)", "value": "f2837659c717b18b82328f86d782c38c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057502, "uuid": "9e594653-8325-427b-8042-5b92ff9aabb3", "comment": "Malware payload (MetaStealer)", "value": "31ef50baf936f13029b00ff5ee131b8a81144108152f7cf00ee027ff54479131", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057502, "uuid": "d5f1f958-2022-4af5-9edd-13e8139f41e0", "comment": "Malware payload (MetaStealer)", "value": "1a83025789c98fb5940c4c3bf06e89de67a91f82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057502, "uuid": "7ecdbdec-546a-4894-a8bb-d4e905e40b9d", "comment": "Malware payload (MetaStealer)", "value": "dc4937b43ed2652f27eb390ff7a9fa2cf3d5fde4f7930e0f5d1f7bdcd02f4e8d08723e5d2ec3c078971512dd8484b139", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057502, "uuid": "8bc577a5-f566-43e2-8449-e70ac8e5db26", "value": "T1B55695BA17048C95D95BEEFFBE30E2E0E8197CC7C785294DB758B53CE988411AE48781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057502, "uuid": "6cc20ebc-2aa6-4967-89b0-9289a39910f6", "value": "24576:JkuZXGBLNRySy7M+mTPhzQI8DD+6NwKFMr8gFXxvcRMSCXvxfxrTXkCxHUM277p:Cu4BhITMcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057502, "uuid": "66ce5268-ee34-46de-93ab-8b4de046e330", "value": 5924778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057502, "uuid": "78b9b7ec-2726-4fac-a91d-0cc5bd5a159b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057502, "uuid": "605ff208-6ae8-49ca-8dfd-1a85b8bb2834", "value": "Document.PDF_72.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f743398e-2d8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022318, "uuid": "2b0bc733-1cd8-46f4-ba1f-f04dafc23db8", "comment": "Malware payload", "value": "32b49b786637bfe320387ba0f5457bfc", "object_relation": "md5", "Tag": [ { "name": "license-readme-builtin", "colour": "#C29DDB", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python-related", "colour": "#A91CFC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022318, "uuid": "d43cd431-245c-4c03-ab85-e7f63cbaecff", "comment": "Malware payload", "value": "321a436a334b38fefbc9facd8bd657f96a0d37da3bc22d5640ea10a94d377665", "object_relation": "sha256", "Tag": [ { "name": "license-readme-builtin", "colour": "#C29DDB", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python-related", "colour": "#A91CFC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022318, "uuid": "5ec10257-c90b-416f-9a9b-3691b54b6cd0", "comment": "Malware payload", "value": "26d29309d639b626ec93bd2ba59cabbc90a27d61", "object_relation": "sha1", "Tag": [ { "name": "license-readme-builtin", "colour": "#C29DDB", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python-related", "colour": "#A91CFC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022318, "uuid": "cd63db0c-66a2-45ca-b798-afc768e118a9", "comment": "Malware payload", "value": "d013aa609fa427655f8251d0d90157de258400f9ee4c97eee8e0bb2b700aae07a2376074f888eb41d828b72fe44d14f1", "object_relation": "sha3-384", "Tag": [ { "name": "license-readme-builtin", "colour": "#C29DDB", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python-related", "colour": "#A91CFC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022318, "uuid": "3f88e50d-48a0-40db-bd4b-64ad36c008ae", "value": "T1122533E94BFB605786413AFC72C183CC0DA35B26AFA4F5F9A0E6469B051F80D1EB51B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022318, "uuid": "bde20a1f-acff-492a-ad8a-e698cc6afae6", "value": "24576:bQ7Ux8l6oBJzFKyYMhnaMtNr5EDWnilql/v6toAcznLbZt:bGYwKyYMhVtNr5LWql/vbnLbZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022318, "uuid": "7f8bdb47-ea5d-496d-966c-a28d17b2321c", "value": 1049788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022318, "uuid": "48e4857e-e666-44eb-947d-e76f868391e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022318, "uuid": "f3f78c9a-e37d-4ec1-af4c-f7eda4c7160b", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b294dcba-2dae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036376, "uuid": "c2ff2b9f-e205-40fc-aad6-0afb44b2e9c4", "comment": "Malware payload (Mirai)", "value": "ab0c6d4e1413d261b86ac6638f38d0cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036376, "uuid": "fbb9daa1-210f-4f19-971a-2cd45c61d522", "comment": "Malware payload (Mirai)", "value": "32ba126d855ad1e5485f461d4ad2fd2f94409d9abfa05cd403c49e694e4ba6a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036376, "uuid": "fe780392-15aa-4cf2-9149-8b898a20a9f2", "comment": "Malware payload (Mirai)", "value": "e35b620b394cc5b9a0eb8bbc8ed610b506e312ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036376, "uuid": "ea0e42a6-a5f1-4347-b0a3-122c01c26662", "comment": "Malware payload (Mirai)", "value": "dc6cd02ef6383b7e3515149971d4c9098951a9d4f61a9ed2b5e1ad3cb6d9379f5089abd63fc183cb0e6ae287e63d836a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036376, "uuid": "4f2c184e-fbf9-44f7-9541-8a96061f7f70", "value": "T19D34C70E6F228F7DF7A987344BB79A20975D23D627E1D584D1ACC2105F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036376, "uuid": "48c44918-f221-4d8b-b7df-20319fb01589", "value": "6144:FnhtuaDnTiWF45B22j40Qg1KVCiF/zmYADJk6l2b2Y/tFTDiczFtorIE2klxzbAv:spQXgnqoIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036376, "uuid": "71cdcd72-815d-4152-9492-6d97a83435f2", "value": 238492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036376, "uuid": "1e2b2760-35a8-44c2-8ff6-826679b8c7c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036376, "uuid": "a5e3b9ca-53bf-43a0-b38f-f1847e94ef9c", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63a6bcb-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775054099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054099, "uuid": "22ac47a8-18a1-4f96-9917-0dcd2faef794", "comment": "Malware payload (Vidar)", "value": "f9b077e592e1c54412ac04de4c5ce951", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054099, "uuid": "291fb1e7-04f2-4b63-b6ac-62a06e098ab7", "comment": "Malware payload (Vidar)", "value": "32fdd832027977d4873c24aa906b86a883d4d877174edc0ed0ef0967f910ed4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054099, "uuid": "2140ae27-8a58-45e0-9224-381f006455df", "comment": "Malware payload (Vidar)", "value": "530bdf0090fcbacf981aedc91ce80cf72f04cd0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054099, "uuid": "7ca83c94-a4fe-4904-ba3d-ac7f860168ef", "comment": "Malware payload (Vidar)", "value": "0a0b04a23917e38ded2ef931f9fb875bdbdd757b7b2f5f4eaac93d76a71b9ef41bf8967f995c63dfe6d5d746eeefce64", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054099, "uuid": "be38bfb1-4428-40b3-9824-27e7a6875d9b", "value": "T11A24229F7737BA40E5FA70B4B1A3DDD60E9B6223EEA8C23064311E375981512EF5052E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054099, "uuid": "43e6cf33-7e27-4300-8482-d22dd3a62081", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054099, "uuid": "368b83e0-e43c-45e3-a042-2ae28fc0d4be", "value": "6144:MAhXwmvDVZI3QZZdK5DPwnX1d2ZriABKrW1mHMi5Few:MAhXwuDIOCDPiwZesmHhFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054099, "uuid": "91f5144a-f995-4023-a6d8-539f9d8ecb3b", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054099, "uuid": "c984ba10-25ad-4bea-82b2-adf83765133e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054099, "uuid": "3706875f-d92d-4855-9dd9-6f0bec5bf46e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9471733-2e0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775075874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075874, "uuid": "edf45108-709f-4cce-a6c3-fbe6a5dbcc07", "comment": "Malware payload", "value": "5c232cde252abbcd87f8497802de7647", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075874, "uuid": "7b9b8cf5-e1ff-4c13-b2d4-b1027dd60eb7", "comment": "Malware payload", "value": "333aae0b09f9a443c3fd9b381f04f684e87aa6ad8fc55f8ac3293e8df80b45d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075874, "uuid": "13a35853-5d51-44e7-954a-4a58a9d42826", "comment": "Malware payload", "value": "ff46221aaddbad872ee6597dd61a7124323d573a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075874, "uuid": "2536c82a-3298-4107-bef2-695ad397eed4", "comment": "Malware payload", "value": "60bcec73208e4e61c3ecb053c5633daf4f481bede84bbfba93e046a635ecc954efa2361ce948aa9e23aa0aac8c1186a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075874, "uuid": "ca81b164-56b2-48a4-870b-bc4cef2b32ac", "value": "T1DA3723258D79C75F46FC2E89643E1E0D2F674D011C4452E3FAA6B9DAC83F9D500A3AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075874, "uuid": "39a694f8-4502-447e-8e19-0e9a44eadf12", "value": "49152:XZ3ZGZ0ZdZjZxZEZcZ2ZuZeZgKnNZoZ5ZXZrZZKnkZJZsZaZGZuZYZpZkZ1ZUZ6R:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075874, "uuid": "02d24f17-f530-4e50-b218-585be340184a", "value": 22571415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075874, "uuid": "01a9f071-7d27-4818-a09c-6ed94d971b7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075874, "uuid": "53145478-6689-4634-be82-f4d88458bd9e", "value": "James_Smith_Tax_Documents_2025.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcdd629-2d85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775018548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018548, "uuid": "05a68c02-252d-4a50-b322-cafda7101f25", "comment": "Malware payload", "value": "dae72afd97f04e76869b298264cc715a", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python312x64", "colour": "#01F3BD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018548, "uuid": "e4f36689-263b-4f2e-9c9a-82c47b3b8512", "comment": "Malware payload", "value": "338dea3ea0f9fc3b7718bff345fc3b705b287b615161f357c5b15ecd630ab4a4", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python312x64", "colour": "#01F3BD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018548, "uuid": "009e5985-f016-4772-aa26-601b48da67ec", "comment": "Malware payload", "value": "d9de8d8a87d816902205c2262e96a146c343f4ae", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python312x64", "colour": "#01F3BD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018548, "uuid": "5a7162c6-7a27-4300-9564-441afbb38476", "comment": "Malware payload", "value": "143c0a30d619ac06346eac71e865bc1feb68af2d26afc94aaf7d7efbdd750dc21a4a1cee7fc3bbd507ef08ed14ba2ad6", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "python312x64", "colour": "#01F3BD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018548, "uuid": "1aa5e491-63f9-4bbf-a0ff-e1346a05cde5", "value": "T17FE63322832AE455DDB33B7839BEC30AD92E86983B06F5CF2D760A6D6C855D0435B70D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018548, "uuid": "51b4a3ad-29ff-42e6-b1d2-93ebcab0dc48", "value": "196608:tSNI3rg2DDB28b2cUk2tf6/oH53smLrOLFjQR6Hs5JqNx3Q8SDUidDOGAXUR4Jhf:rbDVHb2crwizmL0tEHUx3Q8SDUG4E81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775018548, "uuid": "74744582-fcf7-47c9-abf4-38fd2eab5a61", "value": 14579697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775018548, "uuid": "550e0ebf-8eae-48ec-abb2-0b2fc8c0e79d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018548, "uuid": "4ff6daa9-0c42-4f03-ba51-4d4835f51fd2", "value": "python312x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4377df-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775041090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041090, "uuid": "43b22a4f-7938-4871-9468-91e19a33bd06", "comment": "Malware payload (a310Logger)", "value": "3f3158a4bbf6cd0c3acdfc2b16711671", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041090, "uuid": "581afd86-c70b-42ff-94ba-6ecee06436da", "comment": "Malware payload (a310Logger)", "value": "34671e45d3d03539b44eba27e6c78417cb0022bb38de9b96ca7e0f1e9507178f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041090, "uuid": "875719c7-a43e-4ec9-89b7-a8ed28dec7a7", "comment": "Malware payload (a310Logger)", "value": "97ce1d63c1711de92f2fe0f4c9ff701cb1fc549d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041090, "uuid": "c432b159-88e4-42fe-ae56-02c9184f92e1", "comment": "Malware payload (a310Logger)", "value": "e2305f0cd87b0e6d59ff13540ad7ba0ebbece52cae3cd7b17bc2acafac7b9f6184d460a1711f80179d5262d17fc9c5b3", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041090, "uuid": "aa652375-f570-4aae-ab8a-b721f5494c96", "value": "T1C955F1AFD625890BD2901AB4D898F7B517783FFCEE9BC312B9E13CDBB5443816845122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041090, "uuid": "61891c27-7d18-4f9a-82bc-8b3e348f390b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041090, "uuid": "bedeba5f-e079-4087-a5fc-3c880e6c0cf4", "value": "24576:208EAWwwQpxnOsuxpAI5unch+YBLcvGukoV0Es2qrpgAkcOYzGcSyO:20HkwQpBBAttkYBLcvmoVa2IpgTEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041090, "uuid": "1bf35700-7992-4bde-9dee-54c5d366e3de", "value": 1387520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041090, "uuid": "66230c6d-2e80-4398-8977-eb3d2cd47cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041090, "uuid": "3fd2faa0-cad3-416c-a352-93862ec6d339", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76b41b6-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022667, "uuid": "2071bf7c-5fac-4e30-ab11-f74fe9f68933", "comment": "Malware payload", "value": "1b41f0be9457bc1753851849ef55444a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022667, "uuid": "a3884154-d1fb-40b7-abe9-2aa5be7f7544", "comment": "Malware payload", "value": "347b351c941e954b44bb44b19fef1dc718b6df986d5e54ddc3dfcd28948584d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022667, "uuid": "9cba9715-1d44-45af-a3a2-0c23f954a4d2", "comment": "Malware payload", "value": "805b053b4a18f62539f34cbf5cbce7a0b03f9d10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022667, "uuid": "eff8207b-7c9d-4cd0-bf36-d21599448279", "comment": "Malware payload", "value": "0b5d59484fa2368dcf815321d2a2fa84749ff1bd51c60b48f5ae6e7fcae0976d81a780b9b31b4925c8c9d4dbaa58182c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022667, "uuid": "526698c6-e962-4a8b-99d5-07a378a38378", "value": "T180E47B627721DFA1C354C67009F3C76556E521A21BE2518AB378C728BA1162D2E2FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022667, "uuid": "88b7baf5-adb6-4546-bd7d-c66c3de712f9", "value": "12288:Fo4VFy/8CdrPuZ+SNuthtUfQI3IBAK9N8p9WTeqrkg/D5xKn:y4VFy/8qbucSNutKQI4BAKB6qb5xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022667, "uuid": "a8734b24-1b2f-43cc-81b0-80bb4a342c48", "value": 677740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022667, "uuid": "fbfac90e-e463-47d7-8442-c411ab32fde7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022667, "uuid": "c41ce1a5-2b94-4278-b6da-e8999e13c7a1", "value": "bins.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7713a83-2da1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775030855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030855, "uuid": "2465a3b8-199c-474b-bebc-10700253831a", "comment": "Malware payload", "value": "167629efa400492f62c344281a826beb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030855, "uuid": "7f90dbb7-dd79-4126-a78b-0663006575ca", "comment": "Malware payload", "value": "34c1480d1a80a8d654752cb70bb8c5cefbec88c25d3c674827d33295c6b45a06", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030855, "uuid": "a3ef67b0-6810-4449-aca1-0ef03169f825", "comment": "Malware payload", "value": "f12f655d8bc84f425e50a573a7afc23051da5454", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030855, "uuid": "4e9c0fe9-a093-45b8-97d5-6bc08191488f", "comment": "Malware payload", "value": "6dee7da93111e6c56802072a4ef24497e798f0d6baf854e2d59b106623228222477f08ee4400ae9c251d23fcec9e54b3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030855, "uuid": "9cef9629-63e5-4c29-9a85-9d0c50d367c3", "value": "T17066BE32F544E062DCF226B2D27577B5062D7C682F2590C3E29E78CD59B14E31ABB24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030855, "uuid": "a2c2e15c-0259-4c5b-95ce-8389cab82084", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030855, "uuid": "a170b687-d6de-4c6f-9a97-57e47c51cfac", "value": "98304:d0/51GxhiehH7MZcniemJmh333p333MlJrga76Dm7XX:dQPIUZX/Ma7q+XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775030855, "uuid": "a895cd02-ecd6-4f5e-9b4a-00cf89162d86", "value": 6704128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775030855, "uuid": "bdf610f7-59b0-4cae-a8ea-69e020e21330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030855, "uuid": "0e9f422a-44e9-4afb-bd8d-d4ba60cb2142", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfb7c83-2e01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775072151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072151, "uuid": "c11a378e-ec3a-495c-ae8c-5db040ba8785", "comment": "Malware payload", "value": "04ddc7dda0c15e22004d46edc29c192e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072151, "uuid": "d321d0c9-4f77-49f5-b589-1634a12b90f0", "comment": "Malware payload", "value": "353ac6e11cd0ade5d6f58eb4310d7ac254154ea29da3af580f805e0284577339", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072151, "uuid": "d6fbfaa3-d658-4ab9-87ca-79e427070175", "comment": "Malware payload", "value": "9c6ae5dbbdf7239296a75cc94eaf8b4e4eddd866", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072151, "uuid": "33c0ddc2-1301-47ef-bf89-891c5a1975eb", "comment": "Malware payload", "value": "a58eccad637e47fb74052d9a81b7022256369cba077ed780ab012422178fd8fb45a1c20a7543d0e63174f86620f10787", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072151, "uuid": "4e857380-f8e8-4da2-b155-55d6324ee23f", "value": "T1DF168C01E3940AE4E57BD634CA6E8332DA707C499735C74F2559E31A2F33A908F7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072151, "uuid": "d9c83d97-bcf8-4eb8-8721-664e45ba0005", "value": "f6ce430bef194ccec614ed7f4ac68a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072151, "uuid": "8ce2828a-92d8-4585-b568-f43ef58ef1eb", "value": "49152:jGa7rWwXpaHbgrDlmuyREQZ59B1pTYJTYxav7DMu9qIrtF/IYvh+M33RCw6RDOrC:jhi3grSEQr9B1FmbZGYgp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775072151, "uuid": "1eb1f6cf-ed03-41fe-8e77-e169af5f3de4", "value": 4404224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775072151, "uuid": "eb2e4168-4a42-4e50-aae1-7e1273a806a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072151, "uuid": "3bcc6238-99b0-4837-a630-171b467c4c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eeac99-2d98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026752, "uuid": "0944254f-f335-4421-bc68-ab7cc3f4f63f", "comment": "Malware payload", "value": "dae3277feebaa18bc2fe15b3bbe1f8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026752, "uuid": "535a890a-ee59-409a-b788-885242607c75", "comment": "Malware payload", "value": "36170af7b83ba8326125d853ee374c66787e486be8b17b8868e53be2ef336352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026752, "uuid": "585e93d4-b64c-404c-b5f9-5550e17ef522", "comment": "Malware payload", "value": "9bacad0001f738dd51f71c14b794f40cfef7e32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026752, "uuid": "08c30589-0783-4b45-9484-d2575d5d8c06", "comment": "Malware payload", "value": "9f7a34a416cd097de18fac6fe239c92335298c4ba18a25d660e2f60a0e5c42a9264e7f89b09541c6927922de5aea843a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026752, "uuid": "3521c93f-dddb-4444-bb93-fb17caacf676", "value": "T15F0625233ADC99FAC022E538D3555132E2BBBED35EA40AC64A460A3FFF0B546D525F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026752, "uuid": "f5ade628-46f9-43f4-8a83-5443767da896", "value": "55c29e19f00a3ec15270ab84aa4c5bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026752, "uuid": "1344a2b7-38b9-4812-aac1-88f87e261abf", "value": "49152:fuApE3jpQx+K6p8+EtQSmltGvmUyvBZScKZ8zOY0Ybiy:O+xmJ6cCpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026752, "uuid": "afd4287a-5c7b-4dc1-b1ca-041a7e6623b0", "value": 3659776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026752, "uuid": "c5069f54-04ca-4dd3-bb40-d1f9dfd6814d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026752, "uuid": "c4da01f8-be44-4fa5-9501-6d3d27f6fc77", "value": "dae3277feebaa18bc2fe15b3bbe1f8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bd1c5d-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022690, "uuid": "c4b01b72-5cbc-4bf5-bb1e-c48cb9be1d8e", "comment": "Malware payload (Mirai)", "value": "8e4b8e9c306a3a33b2cf8e0378d73fa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022690, "uuid": "36bf7528-c53f-41f0-a384-224b21f49a6e", "comment": "Malware payload (Mirai)", "value": "36dd4570626db015c607de1daae05d5cebadd6fc9bfc4a06d6041fede18814c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022690, "uuid": "3e5d613f-b8da-43c9-961f-139dee07c9bc", "comment": "Malware payload (Mirai)", "value": "713218298be96917c99347a273d4b85fc9c70b32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022690, "uuid": "b567dcef-6eee-476e-b0b2-e223dfd8d874", "comment": "Malware payload (Mirai)", "value": "6bfca4d547955af973a2220568f0716c4c1750eea4bab678ccf2b934ef610f98766ca140256c5fb30fa5742842a90a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022690, "uuid": "519ca46c-1a14-4067-903a-999ada47efe7", "value": "T17563C60ABB610FFBDCD7CC374ABD2B01288C644A26E56B367570D858B50B35B2AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022690, "uuid": "b3340a32-6ecc-45c8-b104-5ed9a424af35", "value": "768:vcHd1uWpKpn5k4EIXS6wsYMHe7UeieS6e0YJm/eVesTZLRXXiLL8ZgwEiz:vcHLuWEDkJIi6jZ3j6YeqZLRY8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022690, "uuid": "b1c45c4e-91e0-4a00-96e5-b3d5a93c2403", "value": 73048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022690, "uuid": "9bc87275-aed9-4f40-a68d-b49c5b5a7e61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022690, "uuid": "ff01bb63-819c-4402-ae73-25496f76f6f0", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3fbba9-2e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078215, "uuid": "780cdb17-016a-4b03-a539-4311101bdf1d", "comment": "Malware payload", "value": "e87523bb8bd4779696eb1fb73834454c", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078215, "uuid": "3c86dd04-6d4e-4b8f-8cb7-1309d3fa57da", "comment": "Malware payload", "value": "38894a0d3089d652bd1f478a161fb21a3800924454bb5c79b391373e2e2e2218", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078215, "uuid": "cdcac0a6-68b6-4152-af6a-573360f9b031", "comment": "Malware payload", "value": "495346ed2ab7385df74cbdefed0289ba50b0dd7e", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078215, "uuid": "20c27f15-0357-4e05-ac8a-826aae7b4b92", "comment": "Malware payload", "value": "f15213074a495408e9d4f27b834a6d45d98cb09a5488a9572af78b8d948ee53ff2b74670b481213d0e6044fe83f52533", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078215, "uuid": "6bf76202-8acc-4c6f-b0d7-49829d1ced79", "value": "T16E1733C0B9E0F410FD37DAF25AADD69F84072E1B05B26102F85F66BE2647562FE5C190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078215, "uuid": "a27667e5-cf7e-4b97-be41-6c10bdfa11ff", "value": "393216:r4Zc8qez5Zrac4eSeJV50F2eQXmAAyrTTrXK4s747+UiXeS5Jse9/45jZJV:/hejn4OSF2e32TfXK4s73UiTqeepZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078215, "uuid": "b42cf7e7-8766-43e5-997d-4974e6b8e357", "value": 19791872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078215, "uuid": "0aaa1023-aabb-4a3a-9bbf-bfe6d8b9dc42", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078215, "uuid": "9b61d161-3c65-47e1-abee-1b2d28094ec5", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc179513-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775063988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063988, "uuid": "bc360c29-f03e-485e-b949-2f6526cd882b", "comment": "Malware payload", "value": "018924edcb842c093e6aced0b2383f4f", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063988, "uuid": "ffc1bf49-8db8-4d84-9e3c-b9a8929d18e9", "comment": "Malware payload", "value": "38912beea95850b26832e4656aeb0c1ea041350b15ce11e48dc6b67996bf9756", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063988, "uuid": "edc9c9c8-1a9d-4e1b-986e-c8e4267f09be", "comment": "Malware payload", "value": "4886efe240a120216ab07c8a2cba08314e6b6852", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063988, "uuid": "cd473692-552a-4ef0-8aac-ab9e5b50c554", "comment": "Malware payload", "value": "96bf254c24364771ec700705b64676fe8b0c0a2a41a46cf2442879bd2bcc2a2b039fd35bf0200bbea1c9bc38dae7eade", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063988, "uuid": "82d0db70-22d1-4257-8e75-bd9156927c13", "value": "T17A0630949EF16700F2D682FAA19BB58CED2E7C2234D9CAC8797FD4B464C1D21FE08546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063988, "uuid": "a3041bb7-9ff7-44f3-83b3-cd5910fd4cc4", "value": "12288:DmnUHOnAnmnUHOnA7CzV7Iplm0l/zkLNPms2Ei:Kn4UAmn4UA7CzV7Iplm0l/zYmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063988, "uuid": "4adeac91-a488-490b-8707-b342670fad3d", "value": 3997204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063988, "uuid": "c65f6d41-ec83-4582-8871-423367ecb69d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063988, "uuid": "6b71c936-e9a1-4250-81a6-40aa2c02dae4", "value": "rsuas.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62385bac-2daf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036671, "uuid": "1e232334-2c4e-4ab6-b21c-04af5e106801", "comment": "Malware payload (Mirai)", "value": "03c4f12be1e60ed144015ff0e15a3918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036671, "uuid": "fa827bdf-0c95-41c1-b6b4-086a26064d0c", "comment": "Malware payload (Mirai)", "value": "38b1260b84d6080157ddc1a5b04727b81383cda5a90b02e1902bf59a0511114a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036671, "uuid": "44df6119-8efc-4bd8-a72c-ff32b7e8cf31", "comment": "Malware payload (Mirai)", "value": "a765746f02d6887dd8e8e6354b188302d4d821cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036671, "uuid": "77eb42b3-68ef-44b3-87cd-8b1f578aede2", "comment": "Malware payload (Mirai)", "value": "a41ec7c6280104181633b61ce7e118b2c537538ecb900877b988063d9553320b558d5d4fd3441d22249a95b4f6ce9cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036671, "uuid": "37dd4a15-606d-4e43-9952-174d0f5b1c1b", "value": "T12783120192958463E1A128B4E4DFCE49E0F771B874DD06F3A39A944F687DA507EF138B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036671, "uuid": "ea44be50-5ad2-43ca-a7b3-18b71fcaf40f", "value": "1536:nQOafW5DLJTcMf8sHNxU6mjJO1otXO40f20opRXVAJIoFJ44eELyxETXHUo7YkUl:nQsRJTkMUFj1M400yJIoASLgKHUo7Yxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036671, "uuid": "55b55513-6864-4297-95f4-d46ce0ef2362", "value": 88304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036671, "uuid": "b51ae79e-b2a7-461d-91d5-b44e069c2616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036671, "uuid": "0c9d1f6d-066b-4138-bbf7-1573cb0032c2", "value": "kurayami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9802179-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053595, "uuid": "2828aacc-b6a3-4c96-84e2-38861200a64d", "comment": "Malware payload", "value": "64b46acbf134ac459a2e4d5425ed5c50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053595, "uuid": "06467eb7-f5a8-47d0-87d6-bfa08faf2faf", "comment": "Malware payload", "value": "3904e923ddf2ccc4c1d25e11900cec9db6beee8d43340faa73b4ad23f198e490", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053595, "uuid": "9f0b9037-573c-47cb-ab42-f2e2aea2fa72", "comment": "Malware payload", "value": "606b5861706ab544fe336c63f46de300b6692c2d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053595, "uuid": "028e96b5-40b5-4979-a140-a1813c7141fe", "comment": "Malware payload", "value": "2dbd349ab54574c4f1f90c80a7135c93ff939803de3bac719ac9cbfab611eadd7b80b6ceca73880164e8eeace1264a13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053595, "uuid": "b8945bf1-8fdb-47c6-9996-e615bc3efa6d", "value": "T1CDB5029E9C80E6CDDE66A3202A51B227FDB44AD224114F66BE88CD934D350F3917CB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053595, "uuid": "d641cd7f-76f2-4ba0-b2b0-3c4d09714c38", "value": "384:/Ck5xO6wpZe0HsxuFzGOGRhqDgNyPmHiUAPpkzIQhEri4KGOGRhzeRCk5xO6wpZ5:12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053595, "uuid": "2f951354-9f4f-4746-82fb-d9cc77c2f4b2", "value": 2486819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053595, "uuid": "9e17c148-e598-4100-a7c3-b33103dfab40", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053595, "uuid": "bf0c7ce3-e0b3-4ee7-a42f-81c9c4967ece", "value": "INVOICE 0326000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001ef750-2e1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775084610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084610, "uuid": "445d33ed-3e86-440b-9d3d-743814212c7f", "comment": "Malware payload", "value": "78e99d39cfd3be101ae2844b81e4ed69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084610, "uuid": "454f9e70-e2fc-4b82-b1db-1710ed51ffaf", "comment": "Malware payload", "value": "391c0e47b09bf141775f8abc54cfe29aaa44b791e77c41d35eaf587bd7df8df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084610, "uuid": "e771cd2c-e570-4f02-a70a-3385f1a17502", "comment": "Malware payload", "value": "00f0379af4f6487e9d788a3e5479493bb80960a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084610, "uuid": "43b07190-5c25-472b-8d53-90c37a398b03", "comment": "Malware payload", "value": "0ffe69d17c264d7a9d0086c8bd3e1c9a3a29e3beef65ab559c788a8767c61c185757b02737492ca00a85e7e57f2f6a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084610, "uuid": "fb869d5d-2a58-4d74-ad3b-75234df1b7e0", "value": "T1D673074AF9829F10D4D813BBFE0E018D33536798E3EE71129E116F11A7CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084610, "uuid": "8e20654d-9b53-47e8-acb6-5829430d3740", "value": "1536:K9nq3zwiiI5npnFUNh0n2wNooZnknrw6iYhf8XllzfisgAXU5wbZn:5jwFI5pWNh0Co2nrw6iYhMVgAE5wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775084610, "uuid": "77659eff-c771-46e6-82a7-69b1f0b767e0", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775084610, "uuid": "c7300c07-d040-4d07-ba20-fef7b307cec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084610, "uuid": "59d3bc58-e71c-4125-892c-3f70e86ed6d5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2104482f-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053312, "uuid": "50b07004-de67-4354-b43c-7734874f8d9b", "comment": "Malware payload (Mirai)", "value": "116052c5690e088d641a82fb9dfe25b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053312, "uuid": "2f5753f5-067a-4985-9382-615002ae1db5", "comment": "Malware payload (Mirai)", "value": "3945a2f61ac81ab5e81f7234653bba6f07d138fbda6ff24c96c3c5077f23b62e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053312, "uuid": "297c7e70-098e-4ce1-befc-745541d9a186", "comment": "Malware payload (Mirai)", "value": "bc571337cbd6183066279ab5cb2b7f0b203756af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053312, "uuid": "99598bbd-7065-4ec7-94a2-16fdbf4156cb", "comment": "Malware payload (Mirai)", "value": "f433f056dbcada967c52dac27eb0a0eea6401b842f6d638bf9d584b849899b43f02ea83925290102773ba9374c86bffc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053312, "uuid": "f25b5624-6757-4fc9-8641-b6926aba8db7", "value": "T172231894B9829A16CAD0437BFE0E42DD3725A398E2DE3313DD225F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053312, "uuid": "3b5a3c10-7c25-4f96-a45c-2b46bd9fe2a5", "value": "768:UXYesyi5wPVQEkJVvOwxPFV4iRu6Jj3oSCt6gPj5+uB4Pl5Q1bL0xkbUFqBgEk9H:VZe4vrR476JdIPj5+uBaluKObUoBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053312, "uuid": "09a09158-a5b7-4655-b771-ea52ffe03bd8", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053312, "uuid": "c1126f03-7174-4756-8e01-03361b61b1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053312, "uuid": "a995ceb3-6601-4d67-94ca-8c176f3d6b37", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6855015-2ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775055818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055818, "uuid": "05c9e17b-5be0-4d22-b69f-d59d39a4923c", "comment": "Malware payload (Mirai)", "value": "380b42581d6386e4d5209061994cfcca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055818, "uuid": "cd68df77-c440-42fb-bd9a-4724139a4df7", "comment": "Malware payload (Mirai)", "value": "39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055818, "uuid": "ef96758c-9eba-47d2-81a1-d8aff0348a17", "comment": "Malware payload (Mirai)", "value": "a4c1220cf272a76893855276a7abcd7935ee91c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055818, "uuid": "0fb430f6-ab94-4fd6-9267-a486de9378cf", "comment": "Malware payload (Mirai)", "value": "ffe62fa2b538a667f2bc5b718118f5e8f3f019f90d0146815f28b2f4af0ac40a8a7075e7d99205b5d75f6cfbd29276e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055818, "uuid": "36c74780-6384-48f2-8756-fd4f0a5df598", "value": "T1E6F05BCD8C41F343C59F9ADD3021C614F007D5D4A9451F0BE74C4972A74A950E40775E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055818, "uuid": "0b1c898b-7f9d-4a44-8048-1038a05d9c30", "value": "12:YkdMvSHvtkdMvx5HvlZwkdMvhNI1HvBkdMvq6HvjJwkdMpH9wkdMAHy:+gvJPvlwhNIZvdtvdy9ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775055818, "uuid": "7425b339-3151-4016-9494-9399834853dd", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775055818, "uuid": "02f68296-db03-464c-a20d-be8813ad3206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055818, "uuid": "d2037a41-a29e-4b13-9fa1-154932efd0ad", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341f3b26-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028433, "uuid": "3eb6efd7-76fd-4321-b011-74cab1ea00ac", "comment": "Malware payload", "value": "161b4f45663c0947558ccf695f0c71b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028433, "uuid": "1d9d5642-0a5d-4174-861f-464532d13687", "comment": "Malware payload", "value": "3aa4815ddc6260b5523a85c2a1746bdb919959a3f438a1487e2cb1a668302bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028433, "uuid": "a40f2ec5-607f-40b2-9830-57e828f5c7fb", "comment": "Malware payload", "value": "bd8163fb660f804b3760b442e617a842b86ec602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028433, "uuid": "65bd2059-8ab7-46c2-87e5-85cf6027f3ce", "comment": "Malware payload", "value": "88c56f40b99101835882b599b4587c8b513ed10cdc80adfe43950bc80c4100e84ee8a40cdc115aacc1c7ccff8b0c6082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028433, "uuid": "3c3ec55b-ed2e-49c2-b61b-012348722304", "value": "T149154A5DEEE49BA5C6E78138CAC64516E271343E13B083CB85C48AF91A1F5F52B3E385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028433, "uuid": "d2dafecb-ccb5-4734-9772-c9053ec764f7", "value": "0ba32c1da80a3f4d301ae22ac13d3b6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028433, "uuid": "7ddbaae6-7b97-44fc-9b74-394dde9742f0", "value": "24576:JuI1zcAEf+O5qk5HASm1XOjMEK69jj/fsE/Y+807AaTDuHsHtF0bIErvyVsMqu5p:JuI1zc7f+O5qk5HASm1XOjpKYfsE/Y+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028433, "uuid": "6165b6de-5652-4407-9ee3-0a4ffdc8ca1e", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028433, "uuid": "cb1f0cc6-0183-4a64-803f-69e4032c1f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028433, "uuid": "77201fd1-2cb9-4f5a-8254-86d5e13cefa7", "value": "memorydmp (5)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e276190-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041254, "uuid": "4b3cbac9-10fe-484d-80be-d63156d474a7", "comment": "Malware payload (Vidar)", "value": "fb05297e4cab16a5f44cf4d1cee31857", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "DllHijacking", "colour": "#E8EA1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041254, "uuid": "33697de3-7015-4d8b-a6c7-7b2d3919c364", "comment": "Malware payload (Vidar)", "value": "3b3eb57f077a05824b98d8afb24d47514dc5d99ddc392f910b1db45ceed26ee8", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "DllHijacking", "colour": "#E8EA1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041254, "uuid": "1a6d0b55-5711-461d-b8ed-1f9ddd269f28", "comment": "Malware payload (Vidar)", "value": "16f0a1cc5f1e5a6c8915db2032625fe190c4263a", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "DllHijacking", "colour": "#E8EA1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041254, "uuid": "59ca9d41-9612-48a2-81d6-8c1dea4a0c87", "comment": "Malware payload (Vidar)", "value": "cc745c1a8aba3166668928161a9dcdfbdbdf9b1f2e26bb648b87f4fa608a3e7183d9a7c393648924d63f0b3c09877908", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "DllHijacking", "colour": "#E8EA1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041254, "uuid": "07890e80-139d-4cbc-b835-b74845ed763e", "value": "T1F0D6AF18A3E404A5D42BCB38CB65C333DAB57DA25676C10F065DF7821F77A628B2F621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041254, "uuid": "683d2be6-4b27-48a5-bd8d-741da1dc96eb", "value": "3212c1692006ef4bc28b91564c2d6edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041254, "uuid": "98cd3893-da4b-4938-8c13-2a4c8c6f02d4", "value": "196608:RqSC6WsiW7lxMkyhSw0jhTTY1Jsys1Xi5RHIwqS09SjaMjme:RqSCDsiWHYhP4Q1J6i5RoS09+rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041254, "uuid": "ce1959d5-9393-4557-88f4-e34d1b95f0cc", "value": 12943872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041254, "uuid": "a407fca4-a27d-4233-8102-9862dac5eaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041254, "uuid": "bc071c68-9281-4219-af9e-a9296b999a6c", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9d3fc0-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022676, "uuid": "cc3dd782-7a4a-4c94-8d6f-f84c039b97c6", "comment": "Malware payload (Mirai)", "value": "018ca5d3a2a3f163b61c36bf2472d4fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022676, "uuid": "d72bb3fb-7bb4-496b-aa24-f9b2bc6e0184", "comment": "Malware payload (Mirai)", "value": "3b4659ca648c5e42edbb1db07d331f9f0561d6adadd6f7a3537c6ddfa3656346", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022676, "uuid": "e1462d17-d760-4a49-a721-0594ef41a156", "comment": "Malware payload (Mirai)", "value": "635234711e97731d209456e1f578246945c41ec2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022676, "uuid": "d7dc4418-9c85-4fef-95a1-3145c88a518a", "comment": "Malware payload (Mirai)", "value": "7c53a6df8d8dbc601be63e09bbbcc92c4e6146a31c4f5c9a4441d335045dd7f516b1e62c0583d1c96c1ad93b51df1d30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022676, "uuid": "56cb72c6-5781-4f16-88a8-69fba1fc27b9", "value": "T17FA2E1A4D0882872EFFF4D3015E986D99B9A7FC95BC9CC8235E9EB21135F930590ADC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022676, "uuid": "c9564ae8-5157-43c7-aabf-48389fc4c318", "value": "384:ZgL65jhnOLQT62UYhSkBlbfyV4Z49Z8/sJejn2M4uVcqgw05VxJL:Zd9Um6Vqro4Z4/7JCF4uVcqgw09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022676, "uuid": "00e2f6a3-2f57-4468-b4be-b6f2359b34ac", "value": 21496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022676, "uuid": "63ae9f77-ebfe-449a-9b3a-62f5a85cf832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022676, "uuid": "0170768d-f79a-4c33-b8dc-45a78450ec25", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e290afc9-2d8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775021425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021425, "uuid": "f16fb43d-dad5-41c1-81b7-ea320d63204c", "comment": "Malware payload", "value": "9279078efe06551d2af36966969610f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021425, "uuid": "05fbe52d-ddb5-4be3-b144-eeddd88199ae", "comment": "Malware payload", "value": "3b9329f4ae485f8337abf4b360f693bc0459c57a715105650d58e20fdf74d11a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021425, "uuid": "9cc08ad6-cace-48c0-b996-17da964ce363", "comment": "Malware payload", "value": "ee0081da6be3711f41a3e83c7bc6274c108b766d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021425, "uuid": "5ace42f7-6977-405f-b4f0-cd82dd661721", "comment": "Malware payload", "value": "7136d9519692c2b9c779e0fce8de1fbb5576a121c9b69f83917b0fab00b12e1379510038a88792650b38c4a85a4f0b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021425, "uuid": "a99bb8c7-59fe-4efc-aaea-e87e10f15570", "value": "T1C9E56C11FDCB04BAE8431E3105AB62AF27359C094F24EBD7E9447B7DFA7B5990832219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021425, "uuid": "afa1ad67-ce9c-428b-930b-5847a9a57432", "value": "49152:73zFfzfDj/4fVenkzIfFnYnPm8bIAw+fPtOhA5Lf2:vFfzn4gn1fynPm8Zw+fghA5L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775021425, "uuid": "a927b863-ddac-4125-8545-58b89066e3ad", "value": 3260933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775021425, "uuid": "6050fa48-3d04-4b41-9727-a2e026b1e886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021425, "uuid": "3e0c43ff-7763-4c68-8680-758746d77c4c", "value": "b_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a5136-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775035930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035930, "uuid": "0aced7f4-bb86-4ecb-ae3d-c1c063491b25", "comment": "Malware payload (Vidar)", "value": "cfe82bb1c95eb44c032efd13047d6595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035930, "uuid": "7af0ccaa-d323-4510-9aad-370b9a14229f", "comment": "Malware payload (Vidar)", "value": "3c4219a4a9bba326e119d6b84453f244faca05adf1da93daf299c5e08f763aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035930, "uuid": "3716cc41-e1ca-4c9c-bbd3-36749ced02e2", "comment": "Malware payload (Vidar)", "value": "5521d86e4a97204710be70d9f59859a913fd6bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035930, "uuid": "fe4f54ae-ab0c-4104-bb60-f7058ebe3338", "comment": "Malware payload (Vidar)", "value": "552f83d9593de79fa36a30bb081fc01317576efbe865b0a485aca501f1d5a4346707e3350a2d2fc756b3c5e562c86d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035930, "uuid": "942bace5-c11f-407d-aa9c-5e2a29c08418", "value": "T106A57C07AD9548FAD05A67328CB7A2927770B8090F3263D31E90BA7C2FB67E06D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035930, "uuid": "1d71a053-525d-4e4c-a06d-c9d40cf2deec", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035930, "uuid": "a4bb5bc5-13a3-4497-9a86-bd27ce17b2b3", "value": "24576:a1aScezIeMkj5VcLRHU5iCVgXJHHyliu3syH0i4AzTY6K6/IiYeN12DeleNK84H5:a1al3eVjILm5NiX55mf2Qhdzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035930, "uuid": "c85e1caa-f6e9-417e-b625-bd30670d96ce", "value": 2190488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035930, "uuid": "0d51f281-9f95-42e0-ba59-b3482dd4fbc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035930, "uuid": "762c1684-fb85-45be-a331-ff6336ba9246", "value": "3c4219a4a9bba326e119d6b84453f244faca05adf1da93daf299c5e08f763aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11341ca-2de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775059969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059969, "uuid": "305d4816-f16b-4408-b7e4-2c38c6d0000d", "comment": "Malware payload", "value": "0eb0c682b0a1ffdaae3edf8404f3a08a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059969, "uuid": "8a6c93f3-4d07-4152-83e6-676e223e65f9", "comment": "Malware payload", "value": "3c48a4c79001beef4b88a43754b33ec57fe4963773ae4f90240acd969e2402b5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059969, "uuid": "e322b062-d037-4365-8027-e941ce491524", "comment": "Malware payload", "value": "99e25174dcfd71e54266540605893ff04ae26599", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059969, "uuid": "fdf381e9-6e3a-4cb4-aaf7-7f10655eb064", "comment": "Malware payload", "value": "e2412045244bcadc02cc5dff0ea8943495ed6b33c8f1e5f99798337b28135bd63b13980eba12f6beb4a7162713c2f2f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059969, "uuid": "9aaf870d-d825-4d45-8d21-72abab294871", "value": "T1A105390D951447DCC47E813588DF219AB4303628573C6FEFA6B25EA41E3ABD07EA1B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059969, "uuid": "c0cca60f-0207-4bb0-a8c5-1532ffdde5ad", "value": "7d8299715eadf6468fe2aef13e8e9971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059969, "uuid": "e9813816-6c8a-40c2-afc8-41f7f8e3c1ef", "value": "12288:wyyFdjQYCJR5VTD85ZLGKPbSrwUNAcC55njdrN7+ipn:w/djQ25Zq3NAckZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775059969, "uuid": "81d0da7f-bc89-4f1d-9449-04f29877af00", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775059969, "uuid": "1dcff319-4902-4214-887c-a2d5303a047d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059969, "uuid": "fe856ea6-3de8-4da5-9b1c-25d1b7c6e43c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a146acb-2e1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082587, "uuid": "489c5099-97c2-4261-9754-dd70147ecb9b", "comment": "Malware payload (Mirai)", "value": "465fab71a15739781f3bc071dbdc6b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082587, "uuid": "324fc6e3-5dfe-44d4-b80a-394d060c3189", "comment": "Malware payload (Mirai)", "value": "3c5af0c30df69b4cff4a08149611824647fe19fde0f9103cc4c174e1f64d2500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082587, "uuid": "7c5bf5d6-7ccf-4a03-aea5-81b1dddaa4dd", "comment": "Malware payload (Mirai)", "value": "364c6b2fda69d0e514a91934c64cda6b875fdd51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082587, "uuid": "d1b7c4db-62ec-4037-aeb9-1adb00efbb37", "comment": "Malware payload (Mirai)", "value": "e10bfb70c3211890c826839468377654eac5cb2a0bd87e5cfca77359d9d13aa457237dd54c8c00d02ba122f7a9562f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082587, "uuid": "b67766fc-2434-47b1-ab83-3055655202ab", "value": "T1D08533A54DBC5A28879128EF3B2B49DE3564CC7CCCF33D256547ED31288B274728EA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082587, "uuid": "4dd62095-0264-41d1-ac10-00d90f2afa14", "value": "24576:reTae8Fk9M3pO/o2dtK39x5rjL8itI8AdA9eRmlI0t3kNnqeyJ6OSulEwgAeRHlX:reVJ+ZCo2dK9H0itIC21wNnlEfAMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082587, "uuid": "03769370-6869-47ec-87cb-f9030c06bcdf", "value": 1840056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082587, "uuid": "02983a0b-6d0d-4e19-b8ca-6b1a57920fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082587, "uuid": "45968eb4-8630-47f5-8840-d7dc0116701e", "value": "wlan.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10beba71-2da3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775031380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031380, "uuid": "9d3c4ad9-ce3c-4c67-bd78-4b4fa0e6f7df", "comment": "Malware payload", "value": "a8672b5a73301420360167933bc6c1f1", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031380, "uuid": "334aeaf8-cc02-44ed-bf32-907e40de0fd6", "comment": "Malware payload", "value": "3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031380, "uuid": "2f193d26-ac03-423c-b8a1-ae361daf4c20", "comment": "Malware payload", "value": "c29bbb61a49331f2ccbd47871eb26f37165955aa", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031380, "uuid": "c1894fd5-2d9f-4014-a3f1-e093f856b4f1", "comment": "Malware payload", "value": "f8d7b07f4169b7a1fcc9e96d10ab94c7d402977f5b84b0c19706b9d9ec9f20418c49f77af4c40c85102b6b33203f8a02", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031380, "uuid": "db10c271-ff3b-48d4-bb5b-db79628670ed", "value": "T1031733E8C389F4D5C51A8F70FF0E5289DCB245957D05C718E90EA3BEA3F2821F469926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031380, "uuid": "0dcaab41-8316-45ce-abed-eb5172cfeddc", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031380, "uuid": "65e90a30-6e88-4e80-9675-8806bb8bb9da", "value": "393216:nAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:nAJw4FVUHjor/n7WG05tUCV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775031380, "uuid": "1ba17e8e-ae9b-4750-9312-24b920c6245a", "value": 19761152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775031380, "uuid": "32ea872f-e87e-4267-b840-1c81a9651b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031380, "uuid": "cec235be-d6d2-43f8-94c0-bc104bd627c6", "value": "Installer_v3931_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4100c8b9-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080853, "uuid": "8342a50a-b345-495d-a0e9-386208cce25c", "comment": "Malware payload (Mirai)", "value": "508e0cbbe4d0aad404b3d096623b1e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080853, "uuid": "e422c9f8-4040-4cfe-ae70-65bc9c938806", "comment": "Malware payload (Mirai)", "value": "3d3f8ae68fa34cb16982e818e0d53ea00303d26eeddc9322104c291790427e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080853, "uuid": "9e8f6c82-189c-4271-8bc9-7943ad64693f", "comment": "Malware payload (Mirai)", "value": "6e5b9ddb049d3bd94fa3334cf8190686d860bdc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080853, "uuid": "432ec268-04e3-41e3-9f41-5669b9cfd549", "comment": "Malware payload (Mirai)", "value": "233e04cc385a6f990252057c291ae5b513bd4e1591b8f143ca9dc412211fb168574f97baad865586e0f498507ebc55a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080853, "uuid": "e4e0fb21-e73c-403a-997b-2d4dc5b1adcb", "value": "T1E7D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080853, "uuid": "0b4c0d08-0811-43cc-ae0e-421f0ec7fde6", "value": "3072:79eSuygEPjt6qkWq6dKmDnYMb0gBd/gQyVGsdqml6Paj:79eSuygEPjt6qkWqpeH2laPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080853, "uuid": "b328016e-c673-42a6-b4b0-15cab0bf1584", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080853, "uuid": "1ad9b035-26b5-4de1-80d5-17398c9d7118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080853, "uuid": "82f905b2-a4b4-4219-9073-6096b453bce6", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba7f252-2d8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775021574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021574, "uuid": "bc39f39a-7410-4e2c-a9ee-f2df2a1d11ed", "comment": "Malware payload (Mirai)", "value": "a4ee121cf534259bbf0863b5ae9b7689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021574, "uuid": "537d4702-1d30-4a2b-b979-513a892b2456", "comment": "Malware payload (Mirai)", "value": "3db7969c50574330d864c08ed6409055dd2153ff8763e8a47e11f8dca9d432e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021574, "uuid": "659fbaf5-7741-46d9-b24a-2ede46d26e85", "comment": "Malware payload (Mirai)", "value": "cbc2744a9809deda0ff45be99eb8e5c5d437abba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775021574, "uuid": "27a16a68-cdad-48f8-ab01-c9ebde4b3f74", "comment": "Malware payload (Mirai)", "value": "4480f93292104f94a58a5297f6eb2c775bd18b7253dc9c56a422cc9dd19dbd1421ed35dcef2b511ddffe83be82930928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021574, "uuid": "e44aebce-726f-4bcc-b899-74e92a4bc50b", "value": "T1A924A70E2E228F7DF268C73547B78A3597AD33D622E1D684D2ACD2151E6034E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021574, "uuid": "e02284ab-fc32-4464-8054-110c143b5c53", "value": "3072:Wc6qANIMErR6ntb4/ESAgFPqhxMbscPLRH/AYCw0v1i6ftvGbG1Wplrz5Y:Wc6qzJrR6t8MSALxM7tCpVGsW/rzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775021574, "uuid": "7f145534-b518-49d2-9021-eac5a189d427", "value": 224300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775021574, "uuid": "45588ffe-e350-4d92-aa2a-cbeb51697008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775021574, "uuid": "cb2b3a25-bcd2-4a3e-8e94-ab35497a5911", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e991f743-2da8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775033892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033892, "uuid": "cf05179a-0d33-464a-a0a4-6fddf6c7d0d2", "comment": "Malware payload", "value": "c331a786842ce4e240f8d5d1d9d3c479", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033892, "uuid": "e8e79276-096a-49a3-9ae4-9f56d3313af0", "comment": "Malware payload", "value": "3dc15bca73cf6ceea3b6bc1db0995b887f001e8ea43e1e0f5234f85b539cdef8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033892, "uuid": "aae76c4b-88fc-4a9f-8cd6-a493982b9582", "comment": "Malware payload", "value": "fc9e4056adadf00e1434c545b30a23657ab58bdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033892, "uuid": "6423759b-afc3-45c3-8469-a0d9da0423a8", "comment": "Malware payload", "value": "f7df150ac4e31a0384ffaf9ffe7223322d67ca492232129b9791a31095d57d1dfe5af328b2dabbbe623f5f760d2885c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033892, "uuid": "061f6a5c-2052-43c9-800b-4e1f8120ecc5", "value": "T17154D0D2EBDD1009F4F79B1ADABD14416A257E9A7B2DE4DD11081C4E0B33A488DE7B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033892, "uuid": "7e205460-3a19-4b62-baf3-fe1d904e933a", "value": "6144:B6bywJdbENg1qxV1QUaxIx/Yx/29aciVev:B6JH8+2/Yx/20rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775033892, "uuid": "18d6e114-5100-4d50-9c8a-7f4fb028e22d", "value": 281048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775033892, "uuid": "0ac566ce-380a-4e4f-93d3-613eb2104d02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033892, "uuid": "670fbd83-b6af-4979-952b-dff8273415c6", "value": "Purchase Order -March -0003779980927366600220091100553_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96b0bef-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022671, "uuid": "fa08739d-9d55-4812-a5fa-3afe16ab028d", "comment": "Malware payload (Mirai)", "value": "44f60266ad68fafa3ae87c0d1a560cb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022671, "uuid": "51698b1a-5e03-47c7-a9c1-1afc750a75f4", "comment": "Malware payload (Mirai)", "value": "3edd11ac6dc90a27a991b2c3c5cd1bf5f8c6b66732e81fef3d02ff9e0a6dd212", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022671, "uuid": "7a8de19d-1511-4664-8135-302ef39af4e4", "comment": "Malware payload (Mirai)", "value": "b88925dcf901f85afde700d6d3d760ce9a0f948c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022671, "uuid": "b26cbe58-828e-4d94-8f41-6065ded09fdf", "comment": "Malware payload (Mirai)", "value": "def915fa260b36eac8c33b9bf7df6d249135ac2273d0046c01809c68ffeb3eb5a92f0888e68d41f94fef334ecbc90a43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022671, "uuid": "ef04f2be-c337-4104-af11-d54037c5dadc", "value": "T1613319A9F8024D3CF90FE5BE54154E0DB9A163D112C31B27A7BBFDA36C721A85E22D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022671, "uuid": "a6840fa4-96f1-4aed-a0f4-8c0fd4f03946", "value": "768:VAe2ayXExe+TAkFO2Y293RC3f+b6SBpK8BBHRsg2PxzuTDr+C4lG0K:+7/X929hC3fEBU8rHAPxz6rX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022671, "uuid": "4d8f69a0-532a-42fc-801d-e63e69569ec8", "value": 50828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022671, "uuid": "bf063d80-ae88-4f69-89b2-7dd42102eed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022671, "uuid": "afee3c03-9d0f-4354-8dc4-419d4e540a8c", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c13c77-2da2-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1775031011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031011, "uuid": "31703e83-55b4-4b16-a13b-2814aaccbdb3", "comment": "Malware payload (Stealc)", "value": "dac4b258670c90d5ae4e25a55154298b", "object_relation": "md5", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031011, "uuid": "d761356c-e97e-40f5-afb9-7d39a0991b96", "comment": "Malware payload (Stealc)", "value": "3f40bfa84157a8d03b0322f6a1aa804de34b7045dff9ac89a08ba67cf1a7b5cd", "object_relation": "sha256", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031011, "uuid": "4ccfcbda-b5a2-43ca-a4c5-2d192d99724f", "comment": "Malware payload (Stealc)", "value": "cf0d4ed9ae5d59ca9dfe2c1d54c58bd141240b2f", "object_relation": "sha1", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031011, "uuid": "b416b25a-ad7b-4c1d-8043-cba1414646a7", "comment": "Malware payload (Stealc)", "value": "92d03cba91ecad7ac2817501ab47d29b5dde1d0665e82319b4c4b1b75b9d10a9b4ffa689f3ba6839ee17c6068ca1e8ee", "object_relation": "sha3-384", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031011, "uuid": "b03d4265-948f-438f-802c-5acd27159216", "value": "T1F1959E0AACD1447AD436533649E25182BB32F8394B73B3E73E10AA383E7A7D09975B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031011, "uuid": "0a06c4f7-6d82-4936-8153-8d9c42852b45", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031011, "uuid": "9528d804-4d4d-4a5f-ac78-3b0d8d7494f2", "value": "24576:4y0XZNtlJzlg6liJhBz5QGnUAPi4qclE4zhpevl1OAT3GRWdtVbXw8ZU:4y0pNtVg6liLBdQGni43H3UyIHrw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775031011, "uuid": "f70cbdc2-bcbf-4802-9c3d-fd6024c89419", "value": 2046080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775031011, "uuid": "89002e19-1e0a-4b37-8ae0-21ae5f6adee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031011, "uuid": "008c8fe3-97d9-4859-ac9a-7f5f8632d778", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056f7c4-2de3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775059029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059029, "uuid": "73388ba2-1454-4a34-a08b-dda2bfb657c0", "comment": "Malware payload (Mirai)", "value": "fa94bf8539aa040e36d037d71b587359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059029, "uuid": "52335c2e-eeb4-4bb7-b020-9779be89eda8", "comment": "Malware payload (Mirai)", "value": "3f5ee6898ec6be2eca2c0dda4461478007d335c15273c294e018ddef3901b88f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059029, "uuid": "b55474d5-afbc-41eb-9959-53e5f455005c", "comment": "Malware payload (Mirai)", "value": "c11ad1b84b0083bd2e3470ec2ee2e7f883862610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059029, "uuid": "6d71e3bf-fe82-4249-811b-d842ea971a97", "comment": "Malware payload (Mirai)", "value": "89692402e5af740688012fcb1ebe5f839015357c1b3ca70dd0fea43116f9f156acd9d7f49a10643c46b1dbbc5ebebf0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059029, "uuid": "f2efda42-087e-4f2c-bb46-c5487dd0ab4d", "value": "T199C32905B30C0D47D1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558AEDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059029, "uuid": "b36c3475-26b6-4b20-992e-81523b9004c6", "value": "1536:LNnCbDcZ4Ox10RXomB7Y7ZraAYWrvAnjSL1ROj6+cTRqadmNuZv3dW6:Lim4OxgR7cZ6WsnCdIas6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775059029, "uuid": "417d5fef-a1d8-4f76-a296-5d0a347675cd", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775059029, "uuid": "2be94a16-63b2-4198-9444-64c298bc30a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059029, "uuid": "78eb4ecc-32cd-4fd2-a899-ebb8e8c87c2b", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c1425f-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1775050589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050589, "uuid": "4791aceb-c855-42b9-8dee-a19cd3678247", "comment": "Malware payload (DattoRMM)", "value": "abb235be43b36292ed2e418a53223608", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050589, "uuid": "04ef65cf-9ad1-4d94-b51b-25ef70484c3d", "comment": "Malware payload (DattoRMM)", "value": "3f66a97ebac4714a1e1e9bf3bd6e53dd3460f2882b74a670dff22e17d7e08fc2", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050589, "uuid": "78681e0b-becc-4dbe-b34d-f235680aaac0", "comment": "Malware payload (DattoRMM)", "value": "54a621e4e5261ab3d6fba39b10f23d9e2ef9f812", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050589, "uuid": "6dff2c5c-e840-4377-870a-a73c0814f6da", "comment": "Malware payload (DattoRMM)", "value": "8c02d1aba9879b1145d2bb3345884ca75879201d2dd958450aa6496925aaf2befe45646a04865d21be9cc03e73490f0a", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050589, "uuid": "955d6ef6-6c26-4df6-aa45-28cd4c6588ec", "value": "T1CDB63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050589, "uuid": "fa1afdb2-5dec-48a7-8d55-f6c0e0ac27d2", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050589, "uuid": "7a21927c-306d-4f92-87c5-c5ac4d7aa779", "value": "196608:baZk+wpP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2P:bnMmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050589, "uuid": "695b6b98-c234-4b07-86e9-b5e72965f664", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050589, "uuid": "2fcffbaa-4ce0-496d-a301-e0036e90c19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050589, "uuid": "309351b7-2b0b-475f-b5d8-1909769bedb7", "value": "RSVP_INVITE_ACCESS_VIP_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c546a7-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775053590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "6e0c1c61-f84f-45d8-8323-1df783334c02", "comment": "Malware payload (ConnectWise)", "value": "8041f5b8daf74384edee1e77e40b9002", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "ecc66f0d-5b74-493e-a9ae-87eea78a7037", "comment": "Malware payload (ConnectWise)", "value": "3f76d2b5fec17cdd478e94f0293fe26dcfa5863a0b1633ecdeb336b2cadc15f1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "750c43cd-d849-48b2-8597-e80206143c83", "comment": "Malware payload (ConnectWise)", "value": "7d5ebdad885495f0ecb5ebc63cece92c8be34ad7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053590, "uuid": "758d3dd9-0639-4a9d-8ded-65cd5ca26067", "comment": "Malware payload (ConnectWise)", "value": "7ae0c11fb22182425f76a63c9746eb3169a94d5c35aa5c17d6e23ae20b63cc38ecfa8cc8a60963a2c332b71dceb0ba6d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "a50e0576-384c-42b5-81ce-396b2f0c1a9e", "value": "T1E5763358F3D585F9F5A3113C85618816B732FC2A1B6196EF03A8D5D23E333E1893AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "67fc5238-cf0f-401b-8af9-c1d3278aa1b5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "8aec491e-6545-437b-b622-fe12e175cef7", "value": "196608:QcoXM/SW+t2PKMmj11DvgKaZca1p1hMkMHcCmENR:QzQSW+tHj1150UcsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053590, "uuid": "93a6a2d8-ffa6-4ddf-b871-a0877fdf14e5", "value": 7782350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053590, "uuid": "4149a636-211d-4676-a13f-2fce04896d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053590, "uuid": "eedbddae-5381-4e52-9c1d-b1b6cfb66e94", "value": "Doc3738493809-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9ee7ed-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775080769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "de89ce37-d381-4271-b545-0f97af32d5b6", "comment": "Malware payload", "value": "d6e80aab77b7b867049114303c3a6d1a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "9419f590-c79d-4e44-aebe-43f6181665ef", "comment": "Malware payload", "value": "3fd7bcfced25e613c777c3bea48708d4a025852afc60c7f3c1e81d9928aac97a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "8e453ac8-6201-46c7-afba-a02abf98d7c1", "comment": "Malware payload", "value": "8f3bec318f7cba9bc488ead40e9d2f3e0f9c906f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080769, "uuid": "b19c7456-3d26-4271-a171-6d821794441e", "comment": "Malware payload", "value": "620b4fdfe7ee13cbe36234661cc8820ae3fb6580de4f2e1882b2945884f4a0fda269a97697e5a901382126f3f0a15e0f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "c0484851-f589-4f40-b495-04e4a07e86fe", "value": "T141E533423FF2CA31C7A06DB98AE4A7579DF6E5681F168BC3AF801C152E152D247361CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "7a6e0819-f661-4256-b010-f16e7727f299", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "b812b72e-39b2-444e-be29-33c1e0c4cca5", "value": "98304:9m5fqLsM/h6eVWNAIInWsB+rHhnz60Tgx:9m8LD56/NPvsB+NOhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080769, "uuid": "83460dea-c161-48ad-8288-2a18cb4aab64", "value": 3238536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080769, "uuid": "20fcbadd-99bb-49a7-8dc1-2ddfff496771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080769, "uuid": "e2344da9-8bf3-4dac-950d-f8f68b6cb769", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9531e0-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775080014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080014, "uuid": "9dbd955a-b58f-4150-a780-25df48dd77af", "comment": "Malware payload", "value": "450d3bc01d4170977d53a176d7765c22", "object_relation": "md5", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080014, "uuid": "d6627dfd-f224-4f1a-8d3b-adeb23e192dc", "comment": "Malware payload", "value": "4011f4fdfaa71572c649941f289fef31eff80f6ec793406614e8e6c9c3417330", "object_relation": "sha256", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080014, "uuid": "1b6aa073-3b27-4fa5-83fe-da3b5c8929ca", "comment": "Malware payload", "value": "9a6d7e28175d96b3ff73e7159386c846b9c73ebd", "object_relation": "sha1", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080014, "uuid": "0deda4dd-0361-4a09-9db1-41e47cbda090", "comment": "Malware payload", "value": "1903dd290bd77434982090e3902d878f08b073f7d1f744ad8ce23a4f03359022e770a7518d56576c594974aa0d68293d", "object_relation": "sha3-384", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080014, "uuid": "68068c60-4cc2-4aad-a566-9fcc51bdc7bb", "value": "T166B633D0F684BFC1A157C47153F880B9EADE189670A3DC637C232B9D65826F776AE009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080014, "uuid": "ec08977c-cb96-4ff9-b8fc-195dd552111a", "value": "196608:JNCeIMKIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9tt5+uWL63x+mb2ZYYLmP8:DCeIMKhOnn7FUNyhGprLz0zeL63Mmb2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080014, "uuid": "d5cfd210-1666-40df-b69b-f1774bb28e80", "value": 10611030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080014, "uuid": "05ffdf86-0019-4935-92e6-afef370c858e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080014, "uuid": "8a41f684-48bd-45c9-8dcb-d9129e68f72a", "value": "puk3ta8cyv1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9434af-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775045869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045869, "uuid": "b64ce0c3-002e-41f0-bbaf-068cf135c5fd", "comment": "Malware payload (Vidar)", "value": "4168145a6ba2fbf27c80ab32f8ceb173", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045869, "uuid": "e1cbeb16-4de1-4092-9057-44f97a9361ec", "comment": "Malware payload (Vidar)", "value": "40a191d9df24f960a53e798b11c16c4be15576716dc351cf6fc7f9ed4e9c1f4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045869, "uuid": "15f4ea38-70ac-46c3-a046-c58915657485", "comment": "Malware payload (Vidar)", "value": "d697317f595e9ded4a7162825bd6ab473f8237ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045869, "uuid": "e964deca-bd20-4af6-b5eb-d2cca785a0dd", "comment": "Malware payload (Vidar)", "value": "c08128a183ef9a6ba030adea3d2083af05f5098abafb65d59c6026a456dad67c46aff67126098fe2ed3cb5237718d8f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045869, "uuid": "53fea5d7-8f74-4599-8b5e-39cb65bbedbd", "value": "T1B1A4384EEAC418B3EC41807F8D334652A7B16C5B3360C25971A8B069BF7FB844A7D56E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045869, "uuid": "719c738e-d8f8-4aa4-b6cc-d76f8aad08ab", "value": "e113244a5e3463d8dc4096b5bad9f067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045869, "uuid": "fda3f5c9-0494-4773-88f1-73783b94dd5b", "value": "6144:Rv1SU61anMTOtImcfW2uG3yTMwdAoCXT2s6PltfYp3XJne4n/ZM5B9KI7r:RtR61anMT2cmPVxtfUNbI7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045869, "uuid": "4b6d9c1a-0b9d-48d9-af7d-46f573bd17bd", "value": 472984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045869, "uuid": "d8217f2d-977a-464d-b3b1-95b1f0ddb9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045869, "uuid": "0a1b7094-1b05-4e0f-a41f-2c7ddc62b281", "value": "cmdres.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16e3196-2dce-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775050092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050092, "uuid": "3dc32d7b-2db3-4000-9c4f-929d5fe84ff8", "comment": "Malware payload (LummaStealer)", "value": "a160f1e21f63cfc43ba32609afb0adee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050092, "uuid": "c6deb1b9-11dc-4fe1-99a1-19cbe2ec1055", "comment": "Malware payload (LummaStealer)", "value": "40c44ed554771b552a99415c737b1ea24cce3d0dc3ed06bb778b8254a3fdc750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050092, "uuid": "e18f6d15-041b-4817-b7b5-1fdfbdb9be3b", "comment": "Malware payload (LummaStealer)", "value": "8b509ee59ce07eb5fc286ff9300112f94af9c9b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050092, "uuid": "5f5c3d60-ef6a-459e-97cc-ef5bf583e80f", "comment": "Malware payload (LummaStealer)", "value": "65f206aa8ea1764f5f648b603617c35509ccf50e84bf2dd2df11b5d5894e6089103e70e2c3a1876a85922ac5c5e02599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050092, "uuid": "3ba4fc1f-3f05-4da6-8fc5-570d5a0da82b", "value": "T136255B83FB4255FAC64D08360B1452616A3DE721670F96A1741E125CCFA3BAB8F72E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050092, "uuid": "3e5d7ffb-60b0-43c9-9764-b4ea5f42ef8e", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050092, "uuid": "a327d1ac-ced0-45cf-9097-cb51b8c2a0a5", "value": "12288:9Lmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQ9vXnfoMC0YYA1hmej:pmv66b32F7wQr7e5BnT6qkzs9MzPAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050092, "uuid": "858c7f1a-bf83-412a-94ae-16f48d105c2b", "value": 990224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050092, "uuid": "9b235571-25b3-4ea6-a413-b193d81e750a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050092, "uuid": "2d43b5b5-0d20-426b-9213-9e54301d0c98", "value": "40c44ed554771b552a99415c737b1ea24cce3d0dc3ed06bb778b8254a3fdc750.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02b2dcf-2de9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775061820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061820, "uuid": "9e057cd9-9ac0-4af6-baaf-3dcdd3f1a51c", "comment": "Malware payload", "value": "ab12b4b3dfe26d2727fbfd905a4242f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061820, "uuid": "b03c5dfa-0824-406c-9460-39b1b27bf8e7", "comment": "Malware payload", "value": "413f7b2dcb5c87d499570487046fe4f26083c18f7d886dbac3193861d7bd1a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061820, "uuid": "494a3f08-7685-4dbd-ba8f-f99998654815", "comment": "Malware payload", "value": "20907220ba95ec9aa4cf531a14b8f0081e9d17d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061820, "uuid": "bccb5289-56cf-4931-ba93-988d5d8af31d", "comment": "Malware payload", "value": "0a48d407af38a62cd63e8a8069478932a094117ac672438b138feb4e6877df3f5f37adab626f4f8f8986b55209441629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061820, "uuid": "fb40c8a7-d113-4895-b5bd-b813d44c3918", "value": "T1A4E3875A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061820, "uuid": "5dd56fec-b943-4e70-8a7d-bc5866437c18", "value": "1536:CjTc2oCR5VutZ57JlqK/KrxLWLeULBgoZhXESToRy63hPtt01UeVl:CjbPirJwK/KrxLWNgoQzy6xPtt0Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061820, "uuid": "0ac308db-091b-4e66-9250-a8939e0b2a32", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061820, "uuid": "9cd94b9d-2514-49e8-b099-3edafd2b9b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061820, "uuid": "daff5532-fbe8-4e59-a969-296d95d41db0", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77b73f7-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775057967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057967, "uuid": "a6d1ce77-876d-4b8b-83ab-1db5d62b8035", "comment": "Malware payload (Formbook)", "value": "a395dbd66d0eadb3f710f55fb9ef368d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057967, "uuid": "22656888-f1ea-4990-9fcb-b15bc2d5ae57", "comment": "Malware payload (Formbook)", "value": "427262d7adf1425d08584710fc8b9749ad91617afb8b80f0ee6af09325d54040", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057967, "uuid": "28804f45-783a-4be8-bc69-9077589cfce0", "comment": "Malware payload (Formbook)", "value": "8ae5f81afa149c3ccf5ccf8a3258082544563c8f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057967, "uuid": "ce8ff1dc-1b27-44a8-984b-1a451ad5be9e", "comment": "Malware payload (Formbook)", "value": "2270b3ed68c5298d0f794ee79106b1a74fe1b64b5dc8940060e677a05e9183b14384d2036bed5481023a02ef5f338360", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057967, "uuid": "2d7f5f76-801f-4703-9f57-b4d505581778", "value": "T13B36339CDBBBE109941B4E784EDBA3DDDEA24F0E465B8C2E31238B14607F84B7705961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057967, "uuid": "50c40136-0504-4cd0-b75b-5318cc48a8d2", "value": "98304:sbrE+fOC54HbPfMUqtwdHghNLPbQN8DGk+3pRmg9Vh2hoWcU8Jce:CY+2caGwVghNLE1R3Cg9VbPPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057967, "uuid": "96a29c79-16ee-4005-943f-0bd2da0bbb41", "value": 5089796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057967, "uuid": "bd724360-3224-4b1d-a05e-bbf935df589b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057967, "uuid": "170e9765-ae4f-4ff7-8784-51686a183c5c", "value": "01042026_1515_01042026_EURO9083783783.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a9237e-2e00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775071446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071446, "uuid": "f934241d-3871-4ebe-b568-0a41c64687c0", "comment": "Malware payload", "value": "878def90bd5e198ae7205abd1bea3983", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071446, "uuid": "88487129-2212-4af8-a062-246a4e242e6c", "comment": "Malware payload", "value": "431305a18aa22f09e8c4a1ef9e007de304af5f7078c7f19e29192940f70ab35a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071446, "uuid": "786fc274-fb71-4fc6-b170-719b19fcebdd", "comment": "Malware payload", "value": "9945051b7c62a88a22a62ba573d4ca8284e29f28", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071446, "uuid": "37756504-b74e-4b6a-b1e6-e4237237839f", "comment": "Malware payload", "value": "c3e5a92c8147ec04503a90c4fe0930ad46f37df99699e29cd43073aa6294c851ce791cf0a46b3ae79f91fb292dfb8639", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071446, "uuid": "20b5c16e-c946-4da6-8ee7-f32fd49b4290", "value": "T186E5330133489DFCD6B4C536CE5EDB6A42B3E27873610D971AEC5E9A2DC31A2310B5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071446, "uuid": "78731982-ab35-426e-babe-f1f15b530cc7", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071446, "uuid": "a99634ad-8b50-4c20-8eef-88f3b8342a44", "value": "49152:+pz3SZvtzr5WWP5mUGqIuJkkazC8KVyRCjgcJOGMg7XWgAPGUQjv/41Afil+:+p0lzVNP5mfuS3rpRbcQGXWgAeUQ7/48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775071446, "uuid": "f0a5e80c-da2a-466d-a4fb-55384cb193a9", "value": 3023285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775071446, "uuid": "f294dd69-75f9-4d21-858d-bd2221c6efbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071446, "uuid": "8356584c-71c9-4722-93c9-6d664768271f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a56b9ad-2ded-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775063287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063287, "uuid": "78e79ed4-4773-49c1-b5b3-5b760de03b96", "comment": "Malware payload (Mirai)", "value": "fe1df4dd0c503588ccac32d25da35700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063287, "uuid": "14079ad6-690d-4dfd-9c9c-e09b1393ec34", "comment": "Malware payload (Mirai)", "value": "432f59f65afee32d2ce442a1a215c12749808908c5642d54fb968b01f1909e4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063287, "uuid": "ae583300-c2fb-4536-928f-d2551a9ea2ad", "comment": "Malware payload (Mirai)", "value": "852e205f029ba388801b3d325be0a923728402e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063287, "uuid": "88c5704e-7834-49f1-aa2f-f376766af87c", "comment": "Malware payload (Mirai)", "value": "482c8b6a5675be523ecd65cc8a70283bfcca87d37a9359cacaa6081d3658fa83b54f9385bef184a650fbe7a7e428c7eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063287, "uuid": "b138cbea-11dc-4367-aa1c-0f73d8d9ff1e", "value": "T1F132C50797BAAE17C8D033371193072262AA5FA55534432FBD0D1C8E6E8A3412D3FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063287, "uuid": "a5e03e14-e57f-402c-93a4-f21e0c102cf2", "value": "192:RrQsOR1CQVBbdWEfohIH0i60vBawDB//UFxfoSV6oDKei4Y:RrQs0Lfx7zvMuagSIoD0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063287, "uuid": "3d27ebca-f7b8-4171-9b98-23ded98a040e", "value": 11056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063287, "uuid": "9716f404-b92e-4821-98c5-f8762f1c1131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063287, "uuid": "bcd0fcc9-336e-47cb-9a5f-647442a9aa2a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e984ed4-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775038463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038463, "uuid": "d8c474a6-4237-4478-aca8-c420881a8a1d", "comment": "Malware payload", "value": "e552c58d7d7eac058a2fdad320ae0a42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038463, "uuid": "71881458-fa03-404b-91ce-447504c721b2", "comment": "Malware payload", "value": "44ac530444d98daca60c6b04ff25d0e335c26fcce9d74cde5a09157a0501b489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038463, "uuid": "b5a0a716-3398-4971-9667-23a01adcc4b7", "comment": "Malware payload", "value": "d0eca7b65ed72163b5c9f7cdb779ab8bfdf66e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038463, "uuid": "ac0d2de0-4aaf-4754-9f2c-df24e77f2fff", "comment": "Malware payload", "value": "86d515ee4259163ec22e711edeb3d1fa7c5441973b4fab1e71f5c02333aa76f9cc692852cbcc4fb1dcdb65e75084238d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038463, "uuid": "d4d11f54-afb4-4844-a9bb-4933fe253107", "value": "T196F54A05BDC42FB6C05C4F3594EA8A9927A08D144FF1572A25A4FBADBC722787F0798C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038463, "uuid": "1affdeda-3d5f-4d01-9878-d083ccffe557", "value": "24576:JauFJnEjfetMlKQPo4HCa2OsOV+o3EMEQz0PZNojbSV3g7SuLmWJS5hQsVR082xj:JIAgCafUsOZ6bSg7SZFQsVR96EtIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038463, "uuid": "ce17f408-9bac-4274-9377-26b9a3e79176", "value": 3600876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038463, "uuid": "109c2c9c-0c97-4a9a-80a9-47e7fa67d6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038463, "uuid": "7ba3d7a5-b276-493e-9c1d-7e04e4cb05be", "value": "b_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb15c7b7-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775039907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039907, "uuid": "acf5e294-f556-4b39-a0f4-b55c5fa3338d", "comment": "Malware payload (PhantomStealer)", "value": "8569edca85ec38d9db68aeaef1af3ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039907, "uuid": "9b115b41-8594-424a-ae5c-eae16d160727", "comment": "Malware payload (PhantomStealer)", "value": "452e056633df2167a77f33ff65195268109c31789e5cbfcaaab83fb27e99c5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039907, "uuid": "e4bccff8-0968-47bf-aee4-b52b2861fa6c", "comment": "Malware payload (PhantomStealer)", "value": "c39f04c0e9b5e4250dc53f6ebf3f1b54a2c11eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039907, "uuid": "3314d89b-5373-42ca-a32e-aea5c297560d", "comment": "Malware payload (PhantomStealer)", "value": "7c17979a3fcc0997ea75b13310d847bc9cfb55107f988991c899af54fcb1d02320ac04ca91365047ec612bf65702683c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039907, "uuid": "539099a1-ec65-40d1-86ed-f4f9dd7e8f5a", "value": "T18126021589C42FB9CFAC5B1C80FE161E63E04A8E4526798EEB33BD46AFE7644110B19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039907, "uuid": "f8c8df66-b506-4870-b01d-d970959e30bd", "value": "49152:XNIjnvLTuAmZSIa1r7zijCO1l2UCYmhviZRRKrY9K7Hc3:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039907, "uuid": "cadfcaaf-654f-40b6-baea-23078e6e09cc", "value": 4742437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039907, "uuid": "5431cd61-e8bf-4b38-91cb-e94ee4603d62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039907, "uuid": "fbe7e41d-8e16-47d8-addf-6f69571277cc", "value": "vessel\u2019s details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4647fbd1-2d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775014720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014720, "uuid": "49586f24-8960-46c6-b809-e120110ab52f", "comment": "Malware payload (Mirai)", "value": "05b0612577ee85ce95552acb9064e5a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014720, "uuid": "6fde3488-47c0-4321-9878-97190bd80cca", "comment": "Malware payload (Mirai)", "value": "457c0eefe1761e19618eb9e190fc2e25e20c5d61a357b3ca54ecd8052a384ec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014720, "uuid": "2621f98c-14d9-4cdc-a603-11133a052891", "comment": "Malware payload (Mirai)", "value": "934a2a75f09b83bb31fa9e125545957a4492e52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775014720, "uuid": "33b61c5d-d262-4124-9a76-7d5d82cf5da4", "comment": "Malware payload (Mirai)", "value": "09b91de28146c9b2eee5fd5892265fdc91693d63f52c1aa43844171e593743408779c992703e65aef9304d9d1d751de6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014720, "uuid": "973ec1a7-0f8a-4725-bece-faf4c8ba0a19", "value": "T1BA143B46EA418F13C4D627BAF79F424533339B64D3DB33059928AFB43B8679E4E26502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014720, "uuid": "bc63e333-1b07-440b-a60f-ab7b1d0e0fce", "value": "6144:BpBz/ij4MBWOxJbftHtsaZ8Rpo8DelVPjbFM/9kp6To:BpBz/ij4YfHtsaZ8Rpo8QVni/Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775014720, "uuid": "0c26714c-f1ba-4eb6-9dac-0c51d835052b", "value": 200461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775014720, "uuid": "109c3255-195c-484d-9bbd-c62a45b7720a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775014720, "uuid": "87eaa7ef-6dd5-486c-b79c-d10f03fc6def", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e54288-2dac-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775035598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035598, "uuid": "810d6768-acf6-4057-b9af-6984f99c6cfb", "comment": "Malware payload (RemcosRAT)", "value": "3120b6950ac8bba32764fda3c93f0064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035598, "uuid": "2310a524-458b-46f7-9f54-228b24e3d9db", "comment": "Malware payload (RemcosRAT)", "value": "45dec334575199a17f733f0001e315d55e9836fdc9508f8983fbfb2d20e739c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035598, "uuid": "dd4ba8c4-3d45-4a3f-ba4a-fee7425dfb66", "comment": "Malware payload (RemcosRAT)", "value": "4717cb3d0374f3c9ffb53a87f79dfccddd0ce6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035598, "uuid": "aa283b89-1199-4ddd-8cf9-babb26880f49", "comment": "Malware payload (RemcosRAT)", "value": "760da23a729a45ccb5a94307022638ecb124bcc50a14585b0bfc0e5bd331bf9971f4c5b663dde08dbaab135ac7a79e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035598, "uuid": "9c442947-7a8a-4b28-9234-c60d908698ff", "value": "T1F35512127BC080B2C57629311BB686641A7C7C301F62CACF63E57DAE6A319D1D636F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035598, "uuid": "e1abc771-6526-4115-8129-ac57a2b5e2fb", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035598, "uuid": "a9efa5bb-2892-4979-a2f9-6632d2fac802", "value": "24576:sN/BUBb+tYjBFHB0XDb4oA3N0L1NlSztZgs6p7T5hX1zJ54D+qN5E5p:YpUlRhAfh1NwgsSlhX1zJ5w+tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035598, "uuid": "c9ee7be3-5403-48be-99cd-dee61feedbcc", "value": 1300534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035598, "uuid": "c4a24d21-03fa-423c-ba43-a6555589d507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035598, "uuid": "f41a3cba-35b4-4233-8fa6-cf941112cd7a", "value": "KEI02030403030.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89837f97-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775060359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060359, "uuid": "31d94a93-7930-441b-b5b4-7ef38f43d6fa", "comment": "Malware payload (Mirai)", "value": "199ed97def2d3275c991eff76302750b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060359, "uuid": "52fe787c-8750-4efb-b7ab-fe8209cdc0d3", "comment": "Malware payload (Mirai)", "value": "46426258196e6fab46e3e776d33b83338e632c3585e7e845b7bc1b15dea58ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060359, "uuid": "8afb8624-a42f-4146-9598-21691c8a4193", "comment": "Malware payload (Mirai)", "value": "2870220e76e195a45d065ca2f9ce6ffff18e3c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060359, "uuid": "85125823-5fdd-4036-8369-6ccec108e9ed", "comment": "Malware payload (Mirai)", "value": "75d9ae45c2414c0cace0e4bd915e87e3e1f9ae58e0459bec90de1709002e594933f1889f565de0ae6420be5ec28e7af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060359, "uuid": "9bc68d80-58d6-404f-875a-5f328436b8f2", "value": "T1CEC35B1774D080FEC8DAD2B85FEAE126DA72B4291138B11F27D86E671F4DE205F6D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060359, "uuid": "1100762d-85d8-4b3c-8423-647ab2a6c872", "value": "3072:qSF/jIh7ibf41Ns0+NnxrMnLAqfBfv9mH:2mjWudCLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060359, "uuid": "b9607b05-d556-4c68-afa4-659a4b2cde07", "value": 123560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060359, "uuid": "b7592649-79c7-4b32-8a66-e375d81ae8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060359, "uuid": "46d811eb-a701-47cb-be5f-bb9fb0e82ad4", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28500777-2dc3-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1775045164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045164, "uuid": "a685eb81-5125-4044-92f8-f4802d6572f0", "comment": "Malware payload (CobaltStrike)", "value": "3beafeeda93eba4978075c0f6d27332e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045164, "uuid": "6be0ad96-e11e-4332-aa56-abc88cbb1362", "comment": "Malware payload (CobaltStrike)", "value": "482d134402fb33d4ded42657dd3473240fccdedb25cee3c3af5de8e4783886e3", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045164, "uuid": "84fbe6fb-c1d5-47d6-b1d4-892162787239", "comment": "Malware payload (CobaltStrike)", "value": "8f1d91fac75753aa8b6c691e248552cd2662090a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045164, "uuid": "249c5de7-511a-4129-9703-17bb3fb8d538", "comment": "Malware payload (CobaltStrike)", "value": "eee0948e0014031e3a092e1df0eccf2905383a70982aad29b2d2f547f61ce0628abb5771c1cd00c535e44b8c170fe375", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045164, "uuid": "bf2e0868-f86f-4bff-9179-8917ed86af3d", "value": "T1B792D83FF70368DDC217D1B885DA6B319EB27823146A772F1778D2702F112982B7A924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045164, "uuid": "48c37b27-4d73-4702-ada9-d45e5fd497e6", "value": "9133e54115603c0107b8f985598440d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045164, "uuid": "92c8860f-fc20-4ae3-a6e8-a3fc88e738ac", "value": "192:CRb9yNFe4YK7AtGGc/HejzPssH3gk2/tp1eMZgq/V5nnnsG07Ryl6rvANExnI2xX:0R4xYK0nsC4k2/tp1kzRyl6MSxny8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045164, "uuid": "0636b98e-0ed1-40d6-b2db-262f36b07314", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045164, "uuid": "5a91491c-74a5-4745-a068-5b8d07ea935f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045164, "uuid": "3e54014e-ace1-4e4d-9836-8c0f4d86af32", "value": "482d134402fb33d4ded42657dd3473240fccdedb25cee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca82fd5-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775041628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041628, "uuid": "51562623-88f1-4155-b0ff-00206262d097", "comment": "Malware payload (ConnectWise)", "value": "15d0430eda5743edb6aa355b32fc1a4a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041628, "uuid": "62f3e1d7-3861-44fe-bc58-7c72d5033a56", "comment": "Malware payload (ConnectWise)", "value": "484a95c32225fa3728494be1e932c47ca11573db7829c0c5257cc2667c2dee8a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041628, "uuid": "937fc275-9989-4bbb-992e-9d1c63e71b66", "comment": "Malware payload (ConnectWise)", "value": "4fc8fa3902c8d3c939a3de8690ba956bc45c7f12", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041628, "uuid": "5358a9b9-ea95-4e8e-b77b-670743a6e031", "comment": "Malware payload (ConnectWise)", "value": "26dbebb078ce1b3bd44e536ec26c7fba9be0d445a6a40fa8efb5a582279514c6211f34ff5d26717ce06ed479f11ecc37", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041628, "uuid": "a1c8b747-f47b-48f9-bfc9-83682a03dedc", "value": "T1C6F633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041628, "uuid": "ed58eb97-96da-4d4d-89e7-f6d16edece76", "value": "393216:GOvTi7hha62L3N11bOvTi7hha62rOvTi7hha62sOvTi7hha62:GOvjL371bOvjrOvjsOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041628, "uuid": "e61e8038-bc5b-4945-9ac8-c85827b807ff", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041628, "uuid": "6839a69d-b731-462e-bd42-046ebf75bd11", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041628, "uuid": "eb310de1-052e-40cf-baa5-75a5d2a6abce", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b21124-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1775040992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040992, "uuid": "e53b9151-33a9-42b0-a89a-1b58285c2d36", "comment": "Malware payload (AdaptixC2)", "value": "4467de8f6d521d6fc6a930fa8ede7017", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040992, "uuid": "410dcc34-f74e-4dba-9e29-4b780ba76b36", "comment": "Malware payload (AdaptixC2)", "value": "485952ba5347aa83f00537a4be0bebb274021f773a0203b65142f1b86dfda34d", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040992, "uuid": "3a930cc1-3be6-4356-b961-16224c3d99b4", "comment": "Malware payload (AdaptixC2)", "value": "e866b3fa9f87a084b610272580428761e28ad65a", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040992, "uuid": "5c270a81-1f9b-4902-ad93-c810cf63828f", "comment": "Malware payload (AdaptixC2)", "value": "932f5586b51c21a000fc01f0d6bf6235e179ec8ef4ba0026272b9c2e8f1ded86ae4a5a1381002815426e23f0d81d7ddd", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040992, "uuid": "aef8da0d-f101-4b6b-baad-18662bc8e248", "value": "T1DE0472499B32305EC11BD2B402E7D6F166A1BC6877B49E2E11F26DB7BE31E50032E6D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040992, "uuid": "78b9d573-86f8-4951-9d1e-a9b25bb2dd44", "value": "16df6e065186bc006634adcd4d5c37c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040992, "uuid": "131bbd05-6739-426b-8a1e-4b793c365eaa", "value": "3072:bokLVUE6BMrDudE0FvmNEIM3V4Wtz3fcaPe8LjfEPYQ+Pcma99RZ9jhXScrni:EWArvQL2VNtzPzPe8LjfEPYQ+PcmOj1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040992, "uuid": "901a5814-095f-4f0e-a88c-c20f95d214b3", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040992, "uuid": "480905de-5ca7-4146-b5e1-d2828cdd8742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040992, "uuid": "1b4f2998-b1f4-4e9c-8b4b-4d2677fd2c9e", "value": "485952ba5347aa83f00537a4be0bebb274021f773a0203b65142f1b86dfda34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34f07c8-2ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775055812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055812, "uuid": "0ba8e42e-efd3-4874-b022-d30e1843b82b", "comment": "Malware payload (Mirai)", "value": "7ce1317c78e77396b31423de337f3767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055812, "uuid": "b97932c1-9a5b-457c-9e23-1038b55164b0", "comment": "Malware payload (Mirai)", "value": "488e652d2a235f453d9ed700c331323d18c538abefbeaedb8323bef873c3f084", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055812, "uuid": "413053b9-aaca-489a-9bc4-972a1fd1e23a", "comment": "Malware payload (Mirai)", "value": "470c76d1c4eb4fa590c2be54c06f900aac806e45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055812, "uuid": "4916581d-847f-4561-8076-656adcdde783", "comment": "Malware payload (Mirai)", "value": "279ad1e83f3741a88edbc62ce2c6303c9cd4084dcebe8f79213dda506dc9b89d43e2236e5e59d8b4f4a29d1112e2ab55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055812, "uuid": "91dc272b-ca22-4b62-9ca8-889cb5f93c35", "value": "T18324D60AAB610FFBD86FDD3702E9070139CC554722A52B367674D928F54B64B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055812, "uuid": "150d23af-16fd-4ea4-8221-2ea15aea3274", "value": "3072:ySVheAzYmWpRHl/m3Oil0MOOUmeBOW91nBIAX8o6Sr1:ySLeAzonHlMOcOOSIW91BJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775055812, "uuid": "92cdb60b-0fba-4f7d-b65f-df21053f5a6e", "value": 227276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775055812, "uuid": "b75711e9-26cb-42f9-837b-5f1ede5f03a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055812, "uuid": "40c58ea9-57df-4395-afdc-276371fa5b0f", "value": "rebirth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e48f2b6-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775057737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057737, "uuid": "405976a4-8b9e-4f65-973f-93504c1cec80", "comment": "Malware payload (PhantomStealer)", "value": "620744df0cd48bfe75e8e1d07ddc9e5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057737, "uuid": "f17fa9f3-5af8-4ea3-9d7d-ed9ed7530a4b", "comment": "Malware payload (PhantomStealer)", "value": "48a4b1eddce020a9bb942c4485c1b65fef5a68ca71513b1435a48235292950fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057737, "uuid": "b2ab52e7-6da6-4384-bb01-ca18c47a5d79", "comment": "Malware payload (PhantomStealer)", "value": "28420c99cb047a665e62b7ce8ba906bba2338af6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057737, "uuid": "a900b500-ce87-4f17-85e7-fb292b4135f3", "comment": "Malware payload (PhantomStealer)", "value": "45aa4e11249855dc90879b8cdec1c22769645d175aa60788d790cacd455456048018d723f4a77acffe6029a88c554e53", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057737, "uuid": "104d5c02-c1f6-4675-a390-6df0c55bf565", "value": "T1BD846B4293FA5608F1F34F48BA7A40615A77BE561D38D12C01AC644E5AF3E18D8BA7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057737, "uuid": "290671bf-74ad-43d4-81a6-63829c9c9f82", "value": "6144:7zktyUi8HTTtgCmKpyyvPTyS9Nizx+YzaJwu7vr/g5mz3l96GcdVStIjzodW8yFe:fkMyvCUsyDFTizx+4MwubrI5mjl9lPYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057737, "uuid": "40f861f2-7786-4943-9ba7-33e7c73480fc", "value": 371034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057737, "uuid": "9d66d1e8-7921-4a71-947a-84c261fd32e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057737, "uuid": "eb188825-0c96-437b-ba51-15fe70337bf0", "value": "SKM766833690.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742ba5d1-2e11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078792, "uuid": "08f9b9b4-52dd-4369-a2df-ba0afa86debc", "comment": "Malware payload", "value": "d3d71939b4aeadf4bc69046dbd629d7f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078792, "uuid": "2652e0d7-cd77-4517-a9a6-d3a8dda0ed27", "comment": "Malware payload", "value": "48d074b48fe295cb3c3c88befdbfcb2600174925c7d3d89648704df24c18f686", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078792, "uuid": "17de376c-bc29-485c-b855-7a9e6d885408", "comment": "Malware payload", "value": "c35ee1cc9a0f824cc231c0c0a6514749befe9380", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078792, "uuid": "c6a3fa12-e3ad-4c79-bfdb-7a4410946eed", "comment": "Malware payload", "value": "1d2ee22e63deae6fa2d6e3983f717b5d3c90fffdae507b53e2374dbb7828c0bd010b4f382d7fa1dc552b5ef40b117adf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078792, "uuid": "96a01db2-45d2-4639-ad94-f9899581cd20", "value": "T171763A58BDD72110D9A331BA46AFD035B03B9D0B161CC9C2F8CD7AD13FB05A546FAA98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078792, "uuid": "4d6b6fc8-3833-40f8-94bb-74efd58481b9", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078792, "uuid": "e9a3748d-2ef3-4e0d-b907-384e4e4b82bc", "value": "49152:1GWShKZK51yVYuFhM+IQXT7IeWyHPDMZnlPqnkcDib/B3Qm+8wyYR6Cw6wR6Cw6l:10N51GxhiehH7MZcniemdDm1BMMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078792, "uuid": "2b332b1e-d00f-4be6-8b94-5b69de4b0112", "value": 7584256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078792, "uuid": "4eecb35f-9563-4b85-b483-84e428db5a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078792, "uuid": "58321ba6-98c0-4131-b5a4-2c6f1d265c2f", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cc05a9-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080840, "uuid": "582c6c11-1faf-429c-b356-e3f186f9cb9d", "comment": "Malware payload (Mirai)", "value": "324ee226cfbb2c5e7472fb03548b8ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080840, "uuid": "79580830-aa98-4cda-b9fd-50fc6b869d12", "comment": "Malware payload (Mirai)", "value": "4a2ff2a16d6e3d0a523e1bc5492aa26b97cdacd3e8e9dbf1b5e1def47178b8ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080840, "uuid": "ae14ed3c-a636-4b55-ae78-baa349bdc2a6", "comment": "Malware payload (Mirai)", "value": "16b0cb9c1a88508f17663ff468568ce714e555ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080840, "uuid": "44ef182d-e31d-4eda-b7ca-243fdc5fec52", "comment": "Malware payload (Mirai)", "value": "c703ec741c02822ed8f28393708719973b10d2c798c138ee8b2c612c800eef9a4335bd2f838e754c052a93ca082584df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080840, "uuid": "86701767-2a79-4e9b-84b3-65830c457a2a", "value": "T1CB13D80EAA058FBDFB59873486F78E169A6833E217C1C542E07CE9505D6034E681FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080840, "uuid": "eeaef283-0129-4bbe-bd1b-5d01009369ea", "value": "768:fI3lh+K87Af9QbD19XDKj+3GyU4/h9dO0w7tJo:g3lhg7YQbW4FO170", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080840, "uuid": "7cdae173-c953-4ccc-81df-2cd3fee330b2", "value": 43812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080840, "uuid": "16ac5850-72d2-4710-9015-40f15c281f0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080840, "uuid": "f29994da-7b88-4cdc-a16a-01d7efe6d1b9", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c60ce6d-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053787, "uuid": "bc24a896-2a78-4dbc-b64d-7f76cb3eb11d", "comment": "Malware payload (Mirai)", "value": "7a8d080ecc2dd9b3e0ca9c32dbe33347", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053787, "uuid": "1634c9af-ea2a-4273-baab-e92cbda32454", "comment": "Malware payload (Mirai)", "value": "4ab0ffffd571765b844e052462deabd6d4a9af19978c329776892cf10bc016a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053787, "uuid": "c115e325-410b-4a80-b1c0-98187026f025", "comment": "Malware payload (Mirai)", "value": "d4337f9059f2a21e0f33ef8d4dbbc8166d9da935", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053787, "uuid": "3200978e-b647-4e05-bf7c-da108a0e3706", "comment": "Malware payload (Mirai)", "value": "81d57d4f38426548e40cfefc3dc21989cd4d67056b637237f791f1a699daf80ba4d00a21d05806f330524e1fbe85410d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053787, "uuid": "1e5fe53e-4e65-435d-89ad-27d60b34918a", "value": "T1E2A1C1F964B593AA2DB0ED7371D6CA42F14020A7F4C91D0AE6D2F0E8498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053787, "uuid": "8eb37097-41ef-4eaf-90dd-56ee91756c5f", "value": "48:vpK8KMV4kIRpKDK1V4ERpKrOKrWV4DRpKQKoV4NRpKE0KEEV4EBRpKUKkV4hRpKl:v3MdbboXkTGEpz7SFXjdfYjattrBjC/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053787, "uuid": "2c55abc8-fb09-4776-afec-1158f4f55115", "value": 4849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053787, "uuid": "751496ac-4a79-46c3-a7b7-f5b8eab0db7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053787, "uuid": "ec277689-1212-4a71-8e5e-f99ad4f1fc46", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a522ce0-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064199, "uuid": "38ce78d3-bc42-40a1-a39c-6022347cfc26", "comment": "Malware payload", "value": "2e2436f5497f7442260593e23ff929be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064199, "uuid": "dbed8a64-1307-4f3a-b54f-e12cae76489b", "comment": "Malware payload", "value": "4aca40c10f8129e3009f07ecd73f9c2d2e170d6129ebf12005f926e0237bedf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064199, "uuid": "c0ea54e2-0f4e-499a-9b5a-991d3e959291", "comment": "Malware payload", "value": "a4c71f7b4b597787bd171f5655b976d1aa525e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064199, "uuid": "af6cfda8-22dd-47e8-b265-3a1f3bbd2ee1", "comment": "Malware payload", "value": "8975d2ded18f36f5450fe44796dde1862526e4f0b1bffdeb10d3832b5cec6e268965cf843b9b25e6ae5753f296ce1501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064199, "uuid": "fa333453-941c-4d41-8146-767c6bedb23f", "value": "T1D8D4AF6A36534E21D2C41733C6CB580193B4978679A7F38E758823A729073FEDE4B693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064199, "uuid": "a53ad2d9-7df3-46d6-b304-ea0a274e70b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064199, "uuid": "7ea64610-aa9d-4d65-91d1-cba5a0fd2b0e", "value": "12288:Aq0TQPOhPreYRw7ijHa6FgSpNscevQEFHugft9G4ftCcQQ:N0z1ren7ijHa6FgSpNscQLOglPoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064199, "uuid": "9967c7c9-5415-4cd8-86ee-739fca05eb40", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064199, "uuid": "ca57919f-9eae-4785-9884-59a30ebd4fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064199, "uuid": "08b86b13-39c4-49ed-a491-6762fd16c3cb", "value": "SecuriteInfo.com.Win32.MalwareX-gen.46346224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a41e8f-2e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078554, "uuid": "5b8258df-55fb-4821-bae9-8a856699e888", "comment": "Malware payload", "value": "0ab0ab1ea8df8af2017969d19e22287f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078554, "uuid": "d18b62f0-ecd9-4cdb-a7b5-e3ae190eaf77", "comment": "Malware payload", "value": "4ad1c6cd5f823536bd576fecb9545af9ffba7be5dd57c221fe4109072e0a07bf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078554, "uuid": "4757a872-3175-4e48-be7d-cc7c5d7e1a7a", "comment": "Malware payload", "value": "b4aadccfd7b2c21261f51ee91f6ce0632fcdcf16", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078554, "uuid": "f7602bce-2412-43d8-b839-6957e1244606", "comment": "Malware payload", "value": "355aa6736effe7cf74e4677ddaa102a258bd65d679ce58c72a3eabb43475b73a9f335e86a36ab8b9c8b627c25ff4bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078554, "uuid": "bd19602b-1c7c-4a0a-bb11-73d5732a5b2f", "value": "T180D733CBBA8C8FADCF475C7A4991ED454B662C29705A09F7E98CCCA5853336702FCA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078554, "uuid": "be58bdc9-f2c9-4380-887b-ab964f6651e0", "value": "1572864:j7tqVQh2Tz9RFdDvUh5cZOMhZ1bjtT82ihm39A9wCGLJlU0ZmLa:j7tqVzXDMh5cZOMHTLihtJAJlrZmLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078554, "uuid": "59327866-e686-4606-9a21-d6a7d1388f8c", "value": 63474877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078554, "uuid": "83489b15-7cd4-4042-802c-6297229945d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078554, "uuid": "df3c3fe3-e690-49d8-a844-4a6e1a65ea53", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05d6657-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057472, "uuid": "a7f4ff53-f3a9-473a-af13-615ac9acb958", "comment": "Malware payload (AgentTesla)", "value": "f40dc6f22c1e0c0ffd116b1d5c2391e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057472, "uuid": "4626e5d1-abec-4613-9b14-5dc6663aa58d", "comment": "Malware payload (AgentTesla)", "value": "4c21680fbb3fd1374847b398856522357b7a388ec559ac4a583487a4929b365e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057472, "uuid": "b54be64d-e8b1-4f4b-a8cf-5bb97da876df", "comment": "Malware payload (AgentTesla)", "value": "09fded1a6d8fa600ef544ede4afad3c84e25f07f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057472, "uuid": "d33d639f-7320-48c4-a347-d1568b3dfc78", "comment": "Malware payload (AgentTesla)", "value": "d864fd0e389814445cc8eea52aa5d06c691dcf8466cc1611ec2d65fe48ba09414a68cc3f5a1c842c36a0c391a8c53ba5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057472, "uuid": "6c4386cc-1f4c-4536-94b0-e199f2edd37d", "value": "T1F0845A0297F98408F5F74F58AA7A10A14A77BE561D39C06C16A9250E1BF3A18CCF5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057472, "uuid": "24aa5b88-e96f-441f-aa72-0e628d03eb2e", "value": "6144:hMM4yPLhnXJVDkxrRWGC3wR1AEAo+dttn2Dk5zKd5Y73WYtkn7gkYVM6AYKRh/RG:hMGDhnXj+4GCARyEAJ3t2QxKd5omekny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057472, "uuid": "ce3a9328-03dd-457a-967e-d5331b9a6167", "value": 374506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057472, "uuid": "dcb7e68b-60e7-4110-9914-a431e59aa4de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057472, "uuid": "306c8cb3-2214-4c70-9f79-cdf54b1da7dd", "value": "PO-2022KL0106.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dba7444-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053307, "uuid": "af499688-4cb8-454f-957b-67c8f20a4c00", "comment": "Malware payload (Mirai)", "value": "cb906ffba3a4611efdbd8f22d4280fab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053307, "uuid": "f019ae41-154c-41ed-a2a4-ef5779fffab3", "comment": "Malware payload (Mirai)", "value": "4c5b939bbd442decde09e877bdc79a11f75d03d4d315fcb3a0e4a10e6f91e8fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053307, "uuid": "d101ae8a-c471-4b6e-8f3e-66abdecdff90", "comment": "Malware payload (Mirai)", "value": "e8e4e623278feb9f79a4907f0e64015669118252", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053307, "uuid": "a1ed8dd8-25c5-47a7-8fe4-5fb16c7c2d5b", "comment": "Malware payload (Mirai)", "value": "9424763fa78dc0f655b2e539e021501e1c870b12a24fa5651468857469e710e0eb0b342c282a0a784efb4077ad5ab9e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053307, "uuid": "14028f50-b350-42fa-8463-54f0bd56d10c", "value": "T1D51349C59A43C0F1EC1112F110779B519FB2A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053307, "uuid": "dc788b1b-baa2-44e6-8917-018cd3330100", "value": "768:x73jOIDzzrq7WiEu+RiUjrejEx63a7x2Rq1z7yvEdTpKMxn:FjOAzwvEuP4ajEgwKkWItKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053307, "uuid": "8c68c3f0-54da-4196-a854-0ab6442a4894", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053307, "uuid": "8b7c6eb0-441d-4a6a-b589-dcc6ba8f98df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053307, "uuid": "492f3fd4-8e6a-4a67-b5d4-68e4173217e4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d295d303-2e12-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1775079380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079380, "uuid": "9f2d8779-4fcd-434c-a74d-9c3f0409ca70", "comment": "Malware payload (Efimer)", "value": "79a53b9864888bd5d5e4e7932844c543", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079380, "uuid": "27174c72-7f78-4bf6-9ff6-9de45ad2b5c8", "comment": "Malware payload (Efimer)", "value": "4d5cdefb912578f58c4f21f11d4e579d8c96e394b0762712a47430f252955fdc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079380, "uuid": "ae1f355f-e893-4029-9efa-39114eed6b91", "comment": "Malware payload (Efimer)", "value": "36bc8e986524b7f17374b8f59845e98a351d766f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079380, "uuid": "6d7bab05-b57b-4d21-b57b-e33cc3aa23f2", "comment": "Malware payload (Efimer)", "value": "9f27e5d1e25ad054fd13ec083fe96fc35f2324fb8120fc7c5bb31208c479339346a9fc435519804c448e2366fa10657e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079380, "uuid": "aafde171-3dce-438f-9eea-3f2747fba26f", "value": "T12FD63319A59212FEE577C078BEE42BF1B4A8F43946709C3F6A54C770AC97290DE2C853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079380, "uuid": "63e38d07-2a72-49c9-901f-3ce8cfc17a80", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079380, "uuid": "63307a8e-dd95-4df9-807f-72dff12d8aa6", "value": "393216:xmRe+6vo533xqcL5ROfXMCHWUjXdcuI3/PGTAI:xmRe+BF0ct4XMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079380, "uuid": "db37f805-8df1-479a-abb1-0b2458b860a9", "value": 12618787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079380, "uuid": "60404717-9d26-4e60-8846-cba558c2ffd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079380, "uuid": "93903a93-fcb8-4ae9-9f9c-d14d4fb86d28", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc760bc4-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022756, "uuid": "ea75f740-08db-4969-bdc0-eba53194cda0", "comment": "Malware payload (Mirai)", "value": "2f440ea9cd22bf6287b36c1a740767cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022756, "uuid": "455ffbea-b972-4023-8ede-78a5a729f1e7", "comment": "Malware payload (Mirai)", "value": "4d8dfdd7fa903b6442674026f2fa8e0a8dd1e051c7133dc20ce61f712fea8727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022756, "uuid": "a03e7de8-496a-4f1f-93d0-64d4eef8ed38", "comment": "Malware payload (Mirai)", "value": "74b378ebf2ec3a9b44c768c038f1b83deb2f0cac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022756, "uuid": "73f8bfce-1d73-4de5-a341-4dc5aa086a21", "comment": "Malware payload (Mirai)", "value": "0dd9b4347d8ffe8c18bae2d7bd3376e2474859dbfd848f05dbd9ebc6edfbc68ae3765af3725b74032d8e9536c57e78cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022756, "uuid": "1affc146-ec92-4d66-847c-2dd3c102279c", "value": "T15B2318C5F443D9F5DD4A05742176FB379E72F5EA226CDA53E3E8C223AC92601A806D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022756, "uuid": "cb347a27-31b5-43e0-b903-f7050bcb0ea7", "value": "768:F4GQ8wF9w9keu4E6E1qYMFnOZUJF8zUklz16193ZlIYhWMDRdYTIWzVCNhO6sW:F4GQJF983E68q9FOZoQTlzk3HBWMF6T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022756, "uuid": "c9836253-022b-4594-b57c-99c77c345fa0", "value": 47088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022756, "uuid": "ad0a387f-d41c-4459-bc19-7b1c006c8a10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022756, "uuid": "b47651b1-fded-43e2-97c4-0f7a5e5c97e9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2eaa31-2e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775081493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081493, "uuid": "8b9d8753-277c-4ef0-a785-e2f2cade3dd9", "comment": "Malware payload (Mirai)", "value": "88eebdf7573144d6b61f03a74d95faed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081493, "uuid": "71374260-f6de-43a9-9b98-8b80cfd388be", "comment": "Malware payload (Mirai)", "value": "4df0c02b95c78708d514c3702c019f36309b3d5cbdee718ac1cc12aca1a37f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081493, "uuid": "a0b74491-2e99-46cc-99fd-856baafe60aa", "comment": "Malware payload (Mirai)", "value": "5f565469afff6f56246965ce3b91ca6b5b8b87c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081493, "uuid": "6f934e78-c5a9-4bdd-b44f-2b29161df03f", "comment": "Malware payload (Mirai)", "value": "1ecb5260f65d567e3377c8e74ebdcd5dd5fcf51df745d16f06d31d104d86b15cede51d3318d44374fbb3fd1c7250407c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081493, "uuid": "7e810f19-dcde-4e71-bba2-9862f444e19b", "value": "T1B933F845BD829906C6D843B7FA1E42CD331173C8E2ED7227DD157F12BBCA52B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081493, "uuid": "7ba5a5f7-36b0-4ca2-b063-9d484684fe16", "value": "1536:6/l3gcxOTLDxdTwo9SWGf26Ui9BwbZnD:ol3gpTnzE9WGlxBwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775081493, "uuid": "04b0a944-5527-4181-92e3-e901cd88ce04", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775081493, "uuid": "da669268-f0cc-47c7-964b-02871baa5244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081493, "uuid": "6d0ec0a4-ad71-4a91-9514-5fbeca3a6ac5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2054a5-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057416, "uuid": "2f4b8d33-ed8c-4bc7-927c-22071c902c4b", "comment": "Malware payload", "value": "31c7c479b03aef2f5cf4947149d69f52", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057416, "uuid": "8ca8c3c6-4b0b-4099-9a41-e0db7863aee9", "comment": "Malware payload", "value": "4e08a1525a62a387595a2e4942b56ec3f3b3259996115ea2e6ea3638ccb87705", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057416, "uuid": "49d83b11-4dac-4927-8100-2839300825cc", "comment": "Malware payload", "value": "3b9dcee197955dc5fd4b15205543cec319003b00", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057416, "uuid": "e85f424d-4a6e-4339-af94-0624c9e51ce4", "comment": "Malware payload", "value": "2ad79c06c06ec7d845382b0f9b347685ca4a20a3fb93f3198c4ec24686689315bf073f85522cdeecd4f0a8dd853a9e93", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057416, "uuid": "e88f8751-5b07-4a79-ae59-ba42c27f6203", "value": "T1DF37D0216180F131D8A24F3349BE9AA425377E20AB11D9BF2FEC3A4C5F76A927535347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057416, "uuid": "08e6aaca-da21-433f-8c9e-ecec5c148e93", "value": "9eadc06032fbb15efff2f4bab49bdf00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057416, "uuid": "9968c2c6-1a60-4bbb-9eba-be708f9dca06", "value": "393216:kiiTDrcpsA4KJmjSO93q43cFezmX7sMv6WNjaGixiHcumCNl+/gWti:N2+QU7sMiWNjOihmQl5Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057416, "uuid": "1f979b39-0f21-4b07-8981-4d972914baf3", "value": 22836224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057416, "uuid": "c970c4b7-b7b4-4a6d-ae61-6457532620f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057416, "uuid": "8c0d74af-49d7-429b-bd62-0b8978f56da6", "value": "4e08a1525a62a387595a2e4942b56ec3f3b3259996115ea2e6ea3638ccb87705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e0302c-2d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775023014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023014, "uuid": "b73f7d48-f1e7-4402-8d70-d51b9cbff603", "comment": "Malware payload (Vidar)", "value": "ed8a69d41619cb79d4781d84b2d5b6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023014, "uuid": "cf848a16-1497-41ab-a352-25577c4142a5", "comment": "Malware payload (Vidar)", "value": "4fdda050c1de4b8be23d429145395a8436c8a4be1e4ead84f2afbeb8893a927e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023014, "uuid": "aeba7c76-fd52-4f8e-b863-ed52b87c58c2", "comment": "Malware payload (Vidar)", "value": "560f92ffef639c9e6042de7a73bd4a1f140cf590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023014, "uuid": "fd5f3057-b8a2-4e1f-9219-cb937f0917da", "comment": "Malware payload (Vidar)", "value": "a12cf26b92ebd5af994bd862e1ee34a9fc2b546a40d299e91c350da21a18f600407194970714773d3cef3b0cdc3c32eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023014, "uuid": "6f49d355-5407-437d-b084-143e755e525b", "value": "T15E958D4BBCD009BAD4AA533688F292917B72F8590B3223D72F50B7783F76AD05879711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023014, "uuid": "4b1a6ab1-2748-4a92-bc39-15f18ac81fd6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023014, "uuid": "7c2336f1-5ec6-4b14-8fcd-40118e82856f", "value": "24576:quPbvj/RGb7FsmpsSSmBV3+ioEhDAYFCGFWPHj/PN:quzvj/qsmaEBVFLRaD/PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775023014, "uuid": "155e6ee6-a1e7-437f-b1bb-d5627260586d", "value": 1878656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775023014, "uuid": "ccbd0efe-df63-4a1a-87ac-4109ccd5145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023014, "uuid": "f0c99bd6-de3f-455b-b006-5cd1573bb5e5", "value": "tr64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa8b41b-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066643, "uuid": "6f8051d2-da33-4ddf-9c4e-25219de930e4", "comment": "Malware payload", "value": "9d62c5b8b6fcced04421e77138992ee6", "object_relation": "md5", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066643, "uuid": "291f5ce9-e2a1-453e-a38d-21be69f2a17f", "comment": "Malware payload", "value": "5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c", "object_relation": "sha256", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066643, "uuid": "1535e60f-6ca6-49aa-9e56-4402ea7343bd", "comment": "Malware payload", "value": "f9c4f5c49737c84b35dcc2ddcb09bad1829fba57", "object_relation": "sha1", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066643, "uuid": "a7d0ca7c-703b-4984-8493-083373e23e0a", "comment": "Malware payload", "value": "f9db9f636c46d7db844c3176128b5ad2a4d0bd3ab615067a08020de0b8c2589afa14985003e89e6eb56c98a8277a77c3", "object_relation": "sha3-384", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066643, "uuid": "a08869af-c3b3-4040-b8c7-46c22a1a2799", "value": "T11C0110FE743234B26F4385EA9D5350D60976D36F0BD06DAC2CE58B3414AE050A12222E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066643, "uuid": "38fd66a4-ced6-40f1-891e-86f79b79146b", "value": "12:SPh897dG3BCFrCR5VZFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:1xdGxCFmX1EDlgNjTidGXhGIBFVR989y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066643, "uuid": "2d17d9fa-74cf-4558-bfc2-8f06898dc11a", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066643, "uuid": "615528e2-3fa7-4fc7-b3bc-2a8cfb3022dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066643, "uuid": "b6c5dd21-c9bf-4561-a3fa-9f11543e590a", "value": "5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e10969b-2e09-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775075238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075238, "uuid": "3c46f334-4d85-4761-bd57-819745acd9ff", "comment": "Malware payload (LummaStealer)", "value": "1326dd9accf07bac670b09993eda3b2e", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075238, "uuid": "791b705d-fa7d-4e41-b171-11d5711842f1", "comment": "Malware payload (LummaStealer)", "value": "510fc02f59bb4c5ee01f7d3cc3cf1fdaa668a6f2c6cb5417363f2b10b1a84979", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075238, "uuid": "0857e64a-98de-471b-a126-ea9868670d43", "comment": "Malware payload (LummaStealer)", "value": "b518144b2b62dc934108f2c0e08addfb4f02611e", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075238, "uuid": "4bce0aaa-6533-43d0-8f6d-ba33b9570fd8", "comment": "Malware payload (LummaStealer)", "value": "19c30eb7cedc36749a5a61d6e8c7d64e84ff48ad058617657e58507b1eaff485babe9b99831390b4d472a5efc335bd59", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075238, "uuid": "d6e0584b-b25b-477b-a770-872edace43da", "value": "T1F2E135A35751176DE2844DDA8108712B61F1C5AB7C2E2169F7C29AEBFC3DE41A538B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075238, "uuid": "a6151b95-9854-4b20-a575-44e886548ba3", "value": "192:fjYe+9sBlQvLZKcpfSnBw841gdaAcF2x4m02rANQtpPhoh+8ZC4bjekzjQ74M3iM:ZmYlKogqBZ4WpADNQtFhohBZ+kGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075238, "uuid": "57fd5814-9aa6-41a2-a24c-08c0c68d2508", "value": 6874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075238, "uuid": "e3f4fc72-ae4a-4239-8ef6-a3493bfd21dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075238, "uuid": "b8cc7c5a-3331-41c4-9ee1-c98e117a1f39", "value": "main.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5027d23-2ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775055815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055815, "uuid": "830aacbc-f3cb-4023-9525-415686e71e74", "comment": "Malware payload (Mirai)", "value": "b5b85eb40c5b9b69c0c09158972d7129", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055815, "uuid": "d650353e-761e-4129-a85f-52a02c33fc54", "comment": "Malware payload (Mirai)", "value": "519924035570035bcdbde620a17ef34a0a97cc36e846a43b796134aa873c5ff9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055815, "uuid": "162a0172-8aec-4877-811e-60a67e1c58da", "comment": "Malware payload (Mirai)", "value": "d580bfce52aa5b6aca2e2e42614eec690abd24ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055815, "uuid": "70a0ceda-2481-48a9-8371-87e137360ba7", "comment": "Malware payload (Mirai)", "value": "64926191e15d0b3a9e36184e825412960cc7dfc72ae06d8a6cc1f76d5656f352396a08f4d9de9ef6d3b626b4bac2d754", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055815, "uuid": "c3d85b08-d691-4495-8c67-3902928606fd", "value": "T1EBE04FCC8841F312C5AB884F7011C524F003C0E4A8001F0BDB8D887B338EA00E007FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055815, "uuid": "8ad4b3dd-7939-4c55-ad66-ac6261a0bb02", "value": "6:YkdMP2ISAM2IE47kdMP2Ix5AM2IkbH7kdMP2I2GNI1AM2IJ37kdMP2Iq6AM2IgO:YkdMvSHvE47kdMvx5HvQ7kdMvhNI1Hvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775055815, "uuid": "d71171f3-5fbe-4e44-8415-0cad82d08598", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775055815, "uuid": "8358f701-c6c3-454e-ab48-94bdfea6ac0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055815, "uuid": "e3ed9564-801a-44db-a8d9-81340c0f843f", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08374ded-2da2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775030937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030937, "uuid": "c74f7ee4-e9fa-45d3-bd2d-247f923bd567", "comment": "Malware payload (LummaStealer)", "value": "bed125ebf5e4973f530ffbcb2466ab10", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5332", "colour": "#C57682", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030937, "uuid": "fc813d24-f660-4fe2-9e53-aa9289fa0548", "comment": "Malware payload (LummaStealer)", "value": "51c33c759a4dce3025317f5be5ae94cb600f67d17d72458a603278c172b039a2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5332", "colour": "#C57682", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030937, "uuid": "43c83656-978a-42c3-b927-17169fc6b07c", "comment": "Malware payload (LummaStealer)", "value": "11ae80c6f792cfc3944fc1059307f8037c66e73a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5332", "colour": "#C57682", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030937, "uuid": "3e1f76b6-5d86-4d36-84c7-1b20c4e9cc71", "comment": "Malware payload (LummaStealer)", "value": "495e51fc52c1e82fc12242caf999ee33444335cb88fdbe061bc861508416a669d4693cddc739feb477ce256b4f64620c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5332", "colour": "#C57682", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030937, "uuid": "9cea01e1-d1fa-4fe5-b932-8dce48f1d938", "value": "T1210733B17C2C72E45779CD3F281E08EFA9779C0AE50A245EEE72741F58869D361F2824", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030937, "uuid": "0ce892f3-8ab7-47e7-a90d-24b425b02848", "value": "393216:Fo1u3VIAvSZgy8XS+CPZWDl08hnJAJj4ib4zs4y1Ow7vdGzP:FgulIxl8XS+CPaDAJsicyEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775030937, "uuid": "6a6b0daf-c40d-4eb8-9037-1ab5e11d6a06", "value": 16919635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775030937, "uuid": "4d357db8-1662-4894-8df4-f17dbd92f354", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030937, "uuid": "6ccab33d-d17e-42a0-8324-f857c1c7edd7", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e493ea24-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1775080269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080269, "uuid": "01cadde5-98b3-435a-8f84-5abd98fb41de", "comment": "Malware payload (Heodo)", "value": "1143e1581b6ce4ac7f461fa1fdb631a2", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080269, "uuid": "6f77b270-1e7f-464a-8498-4ee24a5a2d1f", "comment": "Malware payload (Heodo)", "value": "51ed46f160d65398fdc21c866c817b58c85d3e5ddf772983e41e5f20b156bee8", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080269, "uuid": "9da9ca0f-1975-4fe0-b773-eea4ba59a193", "comment": "Malware payload (Heodo)", "value": "b0716ce0ad9d61083865d1d290ccaec8ecb5e1a2", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080269, "uuid": "eb0ded00-d519-4148-8da1-e47729f3bf67", "comment": "Malware payload (Heodo)", "value": "a8c636b8e06f3b8a535ad092c0c46fb286576bec336cdef583a0f8c5ac7377a3ff2bec82edf4c699dc3d699b3748cd51", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080269, "uuid": "7c49cb1b-3080-46ea-9bac-f41ff92f4c65", "value": "T1B0963343B3C7847CF0920A7A815B84188F977DB585F9191DBC74C6DE2A399EC883BB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080269, "uuid": "e0f5f093-71fb-44c5-9ee3-5f960d9e7f33", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080269, "uuid": "69b1a491-a718-4cfb-9131-bedef047a1d5", "value": "196608:lrQRmMOIFzV+fBcrccs4xo5lnLRJm4KMdf+41GjQIO+XXd:2F0csUo5lnLRDKMdr19+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080269, "uuid": "d8981f7a-0d5c-498f-a649-ac655d8fd0cf", "value": 9014253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080269, "uuid": "85beccce-042c-4303-8bce-2df9f58cf095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080269, "uuid": "e4a29a9e-9b00-4d14-bc4c-4d73395550fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957556b0-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775038046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038046, "uuid": "bb13a525-60a5-4a5b-b5ff-4fe5676567f5", "comment": "Malware payload (Mirai)", "value": "894b510abdc0afcf19727527bbd9c1ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038046, "uuid": "802685f3-8df5-4009-aa3d-81dc158b5cb6", "comment": "Malware payload (Mirai)", "value": "52812e6737d3666499f3440a03723fcd2fda59e47e738658599fa2d8b92f8e7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038046, "uuid": "81273248-4181-4433-bbc1-0d7c3ec7b0e3", "comment": "Malware payload (Mirai)", "value": "20b8e4acced74ba8859930bc156ea217f2a59509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038046, "uuid": "9c098013-6bd5-4ded-a2ed-35bb190af33a", "comment": "Malware payload (Mirai)", "value": "e35e6fad6d91193656be4169dc3eaad604b2f7512641031741c30a881e605fb80651cf766340e04c309ce30ac0eecadd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038046, "uuid": "a5df38dc-8b77-44a8-b9db-3a9afca1a817", "value": "T111141886F8C18F11D5D012BEFA1E128E33135B78E1DE3212AD255B21778B9AB0F7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038046, "uuid": "41dda568-194c-46e8-8666-002aeb314785", "value": "3072:SoHOLb7otuoJBONyMdUyGBZ1XSQHjoWaS7rbdKtuSarTErqxg1:NHsbFA0kMdJ41X7HjfaMAtuHTErqxg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038046, "uuid": "a2cb3f1c-1944-4b20-9a4b-4a6226f30c07", "value": 196988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038046, "uuid": "e0981b93-fc91-4c99-abce-f7b467c272e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038046, "uuid": "c61151d2-0435-44c2-bc83-96bd0fafc45a", "value": "kurayami.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2253601-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053609, "uuid": "7c32121f-d60f-4d36-bf1d-75b31314d0ba", "comment": "Malware payload (Mirai)", "value": "bf32acad80d9cf042e58dd93648a058d", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053609, "uuid": "4363285a-e8fd-4336-bf32-1c2aa7bc7721", "comment": "Malware payload (Mirai)", "value": "52dae64b4f830c0437008cae906f34607b4016bf6e68c3ace0816b6872b2bf5c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053609, "uuid": "a6760861-6f74-4b1a-aa01-a39356a427d1", "comment": "Malware payload (Mirai)", "value": "05591ef1b6d11ed86dadb5327353f266a1b1b9ad", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053609, "uuid": "1beab993-074c-4d37-9f52-57f310826c67", "comment": "Malware payload (Mirai)", "value": "78154b4aaee2772e38fa73e5db9f756ae0b959e7da2987c4626da4839950a6a704ff765228411b99eac1b49bebadac5e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053609, "uuid": "5a53f7e8-bf6c-494d-9d9a-18666f2fc815", "value": "T1DD73126221B6DEB1E2B2843263477D157D23887603B463BABC7DA71FB487E115C0C84E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053609, "uuid": "c0725cff-b565-42bd-b0e3-0001e6b7c709", "value": "1536:l8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmWXIJors:SzRnwP0bMQ2RijvDZZ1rYGhG13ECSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053609, "uuid": "5704d9e4-e2fa-46d1-9d59-2376ed54c3d5", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053609, "uuid": "2fe01b3c-323f-4177-b0fe-100721396b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053609, "uuid": "fa0a9ed5-7860-49ca-9806-6efdec207627", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c866709f-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022669, "uuid": "95f78e1c-e716-4929-ac89-afe6888817fb", "comment": "Malware payload (Mirai)", "value": "a65acea845b68f9ca96189c7c852dbf2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022669, "uuid": "09dc5e0d-1ac4-4106-92d6-33e0cb53df62", "comment": "Malware payload (Mirai)", "value": "53698d89b3cce77d5023d421e065ffd2170019f91c219862d5985278d082a1b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022669, "uuid": "3105669d-0bf2-4e79-a8af-a55f09e3c5a4", "comment": "Malware payload (Mirai)", "value": "b51fe5d102c20fccd3d57499baa498564300fbde", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022669, "uuid": "31f90e91-5c84-48a7-a095-1158de089c1f", "comment": "Malware payload (Mirai)", "value": "c3bd9fb419e157dc353cf5bafb6abb433f30672d72b97b3ed95f2373c237549b321084f379ee53c605f553c939e4a6f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022669, "uuid": "2e3dbd6a-4a32-47c7-a940-7196e3e43b13", "value": "T19423F170206579A3C2903C77CD958FE7ABAD4EB895FEB0F107D2C68C486298D6266743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022669, "uuid": "f1cce51c-58d6-40bd-890d-65be5e5ffdb9", "value": "768:wKAVMQNRAGv2ySCzszhn3tj+J2czk9jg1jiq9q3UELjb030cPndRomvBg9yfmUsc:TSTNRbv2CzAndjwpkW1mLS0nmCw+UsTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022669, "uuid": "a9dd3b46-ed8a-465a-a5aa-7035acbb9710", "value": 46952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022669, "uuid": "8d39de29-e492-446e-8119-8f3ecc2a6f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022669, "uuid": "f2cd03f0-c9a4-442b-bb09-70afa55abdea", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e17df6-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080754, "uuid": "0a1b55ff-8dd4-4e27-980f-ef94c4491719", "comment": "Malware payload (Mirai)", "value": "8918fefaca38e5976750e9e24272abd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080754, "uuid": "45a1837d-ce5a-4cdd-85d7-60070a724821", "comment": "Malware payload (Mirai)", "value": "53c9b8644419313db9517180fa496a358aa6bef523a3bd97bdedea70e2ac1ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080754, "uuid": "209c0e67-faef-4df4-b983-0bebf83607a6", "comment": "Malware payload (Mirai)", "value": "bf5c95d141319ca20eec903b8572b54a9579e976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080754, "uuid": "76765879-4261-4f9c-b8ad-45c66e3a3596", "comment": "Malware payload (Mirai)", "value": "5f976147b7cbadb0e01f2303074a153abc048ca2cf85975abc20fc02878ab19c8b1a32f9aee3513cc7524f2ab7329fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080754, "uuid": "e91b9836-5d0b-4b28-8cb6-d818d804d54b", "value": "T192E313BDAE024012AC78B972940DC3093A519D0F7B21A5ECDE8D78C652FD5578B8BFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080754, "uuid": "d986b851-ada4-4b40-b1be-61a844a03f7e", "value": "3072:SBPkE/M37KXUlvobRAqZVrTXiqG1ut4HWaHhIyDwG9Z5+C8f3o:SBPkE/EplCRAMPK1ua3DwGH2/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080754, "uuid": "c0bc538f-3d82-45b2-af46-31ebf3a105b2", "value": 145184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080754, "uuid": "368b488c-cd84-4dca-a51b-04a47cdbda69", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080754, "uuid": "737e5c3e-1eb3-42b8-9c67-d4bc4a3dbbb7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f0b29f-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053715, "uuid": "55a0dbaa-fec6-42cd-8b90-ba07d5424780", "comment": "Malware payload (Mirai)", "value": "afb657f031bad9f8a62483327cec7967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053715, "uuid": "aa4ad678-b9b4-4cab-a69f-a4d21aaff4c2", "comment": "Malware payload (Mirai)", "value": "53cfb7b0e65b4a80426cff5d2f3f081bf86c182e44c82bcf8b1f02acc19fe25c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053715, "uuid": "74ca03fd-eb89-4053-8180-c2727594ba64", "comment": "Malware payload (Mirai)", "value": "df96e6ab5aa4fa15c8db26b0e351f7b90b89cf35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053715, "uuid": "7ee75bcc-bc20-4f87-bb06-dd2eefafd70c", "comment": "Malware payload (Mirai)", "value": "2aa257376bb2f02179ca99b1ecc4fb055203f05ff4debf5993beea67c0c1e4e59527274f5cf379535400a2a79476986f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053715, "uuid": "33cb65fd-1e72-4bc8-819f-f42b90af4f85", "value": "T1E2F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053715, "uuid": "924d87e1-85a3-405f-9b56-aff6c0e70503", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHCfam:9FJMgWPZr8IaCWReS1WpPez7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053715, "uuid": "7cf25f2c-28f9-49e1-bcdc-fc63cbda7bee", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053715, "uuid": "83b42348-e55d-4217-8628-5a4a7a0eff9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053715, "uuid": "c20948fb-8d50-4ced-b9fa-cf86328ff9b4", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a680531-2de8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775061247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061247, "uuid": "ed46ec18-9211-4b93-b388-2c5630016834", "comment": "Malware payload (Mirai)", "value": "298ff8a6a04593861828e2392433e81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061247, "uuid": "74ae9b5f-1966-4256-9339-7e8c5cdc8792", "comment": "Malware payload (Mirai)", "value": "546f9791429d4a67c72f5fbca785e424130760cb491668496bfe77d3a8648ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061247, "uuid": "b6889c2a-0fa6-4c6f-b7ba-1ad6af55ff0e", "comment": "Malware payload (Mirai)", "value": "c888e5402a27169a60bd7e0b876411bef2002e70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061247, "uuid": "e1c69e23-b8ad-42de-be74-f69e9c59e18b", "comment": "Malware payload (Mirai)", "value": "6c4c611fb7ada242f9952797135c7a8310685304493b3191d84302a8269fd0224bb8ee5c76c490ff1af8949089930754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061247, "uuid": "84be5e8c-0457-4e86-a810-70e45d16a55f", "value": "T1E7B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061247, "uuid": "f88d1083-112f-41a6-8a47-47279dcd4148", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1e/LWy:c9sSyzz36YaWWgg1eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061247, "uuid": "1aa46451-0b64-4bc3-9ce8-d0cc16bba4ee", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061247, "uuid": "17a678f7-05f2-4c2c-a81d-916df5d5f64a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061247, "uuid": "e5d5a4ab-2178-4d25-82a3-6611c31be7b7", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c355250-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775028527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028527, "uuid": "2242c08e-e1c1-4297-92aa-45720edde522", "comment": "Malware payload (AgentTesla)", "value": "672364c2db33a6bf5eaea77b750c12a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028527, "uuid": "d91d7622-b281-4809-a8a6-1da9ee40400e", "comment": "Malware payload (AgentTesla)", "value": "54b276fb6c125cba9f5d0bd7ef37a94d2f99d16385b4c4bf4d9631152c6951d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028527, "uuid": "6db1b07d-6a52-4ebb-9def-b630500f3c7c", "comment": "Malware payload (AgentTesla)", "value": "7657a5e70a1f6c89d20b6345797e204467e3db64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028527, "uuid": "cb55017a-3a95-484c-be11-046d8cd9b3fd", "comment": "Malware payload (AgentTesla)", "value": "31373c6583574317aff9b045b72b5ebc286116fe4b94ecdfbb1fa06cf618690c84b929410fcf0594ffe9bfbcee06470d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028527, "uuid": "22544ca6-5c12-497e-82a6-e07817da561f", "value": "T1BD5501118DC46FF5CFEC161990FD1A0E63E05A8E502AB98AEB33FD47AFB79441217189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028527, "uuid": "88f08ff7-f994-43fd-a8f8-9fd475c979d5", "value": "24576:W5IJgExMksrx+HnNrD3Y1RhqbZ8+nqOSSD9Uxjl:WyQAlD3YbYM5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028527, "uuid": "b28adfec-4a1f-4db4-b005-21b98ab3c810", "value": 1286197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028527, "uuid": "822b39dd-a40e-49a3-9044-e8d86f993ffc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028527, "uuid": "063baf47-3000-4975-97dd-2f1982363388", "value": "INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad61a56-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053570, "uuid": "c50edf7a-cde7-41ea-ac4a-675ad2cf922b", "comment": "Malware payload", "value": "3d589d89fb5355f1b7aae50fbe318f12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053570, "uuid": "8161ed08-b6a7-4068-9564-9333b1cd7245", "comment": "Malware payload", "value": "551bfba96cfceabaedeacc08333900a993591f580e079f23f422e78750292ac5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053570, "uuid": "3020bd04-bfad-447e-abc4-4665caea4ddf", "comment": "Malware payload", "value": "2fc2be932b981db3d4cc27ae485694219647cac7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053570, "uuid": "8f8402a1-85e6-417a-9b06-76146baabfec", "comment": "Malware payload", "value": "32bc87bb8d5499a467c05bea30b03b455bab380d5e659bbb0b0bcd76b4385e49e6bede3956bd47ca51fbf19ccee9f991", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053570, "uuid": "d68a4a02-3d56-4e68-8365-2cf5bcfb5322", "value": "T151A512ED35E261D757480597A47E2F848BF25A07A391872EDC02A1F5C8B78CCC5BE827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053570, "uuid": "aa1382f9-a353-4120-98da-912b89f940b5", "value": "768:ojQG0xxRQXEPmSYE4kP+6qW59fQwxKaAywT3QJoA/hHL0qBIfB4TxGRuR9W4NW2L:J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053570, "uuid": "7368c474-00da-47bc-a68c-3acdcbb5188d", "value": 2107753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053570, "uuid": "5b779351-682d-4886-9368-f0cbc433f1a3", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053570, "uuid": "4cbc81fd-bc23-4f01-82d1-c13dbccf580c", "value": "bui.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11508db8-2da7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775033099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033099, "uuid": "4a21b966-0ca4-401e-9023-cf2aac4bd9eb", "comment": "Malware payload", "value": "798d3bb4b3caf105b7a2df8865271a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "floridacambolashop-com", "colour": "#D20835", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033099, "uuid": "d213c7df-658d-4301-8e21-f96e4650a615", "comment": "Malware payload", "value": "5670707f3704c17145353742fed1c27aae3f4d52ceae99b12ed8c55400fc55fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "floridacambolashop-com", "colour": "#D20835", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033099, "uuid": "284a125f-bc1a-482e-b541-7e52527edeab", "comment": "Malware payload", "value": "53349919a3ae295cbe2fba0a47e5ab0474663847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "floridacambolashop-com", "colour": "#D20835", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033099, "uuid": "d53cfc8f-850e-495c-9710-4a88dcb9f3dc", "comment": "Malware payload", "value": "cbcbc1237fb0116e8bdee568a0f0bfad89119491493b8b6670e3ef4ee962b199c7e2413b5e038aeb331b68b1e06fff02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "floridacambolashop-com", "colour": "#D20835", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033099, "uuid": "b149a015-e3b0-43c3-9228-78bba0ce59fe", "value": "T11A18332135D7456AE19AD27611CF2823C1DF5E1077D73388E809A2ED7D3BA90EEC8627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033099, "uuid": "92d88340-6e7a-4456-8d74-39edf5dc88c1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033099, "uuid": "4ff80ce4-d793-46d7-b4c2-bf1518aee0e2", "value": "1572864:SR41uucWbDGxwdspDI0GnL3jmVOwKo8vj3MKcrbgjgKZwWlDp07UygHrlY/z7qf2:SS/bCx6shRGnL3juvIDMDgTlp0Ae/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775033099, "uuid": "d58ca038-8778-4b61-8558-beb534775799", "value": 91018232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775033099, "uuid": "04baca26-551e-42e6-8e7e-bfc96f824fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033099, "uuid": "2f65dcb4-9595-416c-8c8e-1a9af9e78820", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbab267e-2e22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775086213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775086213, "uuid": "0e4b3bf4-7c35-4abd-b9c8-2d98b8d4afd2", "comment": "Malware payload", "value": "e4a913d0dfce3c5c606a573680a19809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775086213, "uuid": "6b1b3d5c-bad3-417f-9bc1-81b94cf19c2b", "comment": "Malware payload", "value": "57042f24dd6be7714d9b9dfe7cfb70fbbf717341e85dd1bca82153ff19e4e909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775086213, "uuid": "0c7f6539-df87-4b06-b93c-ee2a0528bf4a", "comment": "Malware payload", "value": "7764c4604b2db4d584f65a2c665e4a5c3e99151a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775086213, "uuid": "089a3051-931e-4183-9914-137db23a9b67", "comment": "Malware payload", "value": "d94845f6a4024e7a4bd43d58162f9b2f1897bceb6f8fdea8c556d3baf33f8c568a2d3b70caccd00e49b61833db629304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775086213, "uuid": "b03a4dfd-1615-4dee-b8af-e6cc9dc69ca6", "value": "T1B2C402C47D25E59BE41C0A760B27CA5F15E0AC22ED23E2FF1619BBCB3E7D1409917294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775086213, "uuid": "ba92c20c-bda9-4442-a5bb-6dc4fd619512", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775086213, "uuid": "a30ce423-a7a6-48a5-8f01-3cefcc4d3042", "value": "12288:vMwW8XnNEGUykGh/oC5zvXVTKlsyBz7Jf:vMwFXgOhlXVWlsazx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775086213, "uuid": "85f81c20-22d0-47ee-addd-2ac7a974e11e", "value": 556074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775086213, "uuid": "153b489b-d0d6-4f7e-9c92-f6fc6094f95e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775086213, "uuid": "1427b58d-e83e-4a03-8a77-632cc715f0ce", "value": "rSparepartlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d116b19-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080901, "uuid": "891fae08-554c-406a-bad5-18700d4d9f03", "comment": "Malware payload (Mirai)", "value": "daccfca549a9bdd7308b8dfb9fca2b51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080901, "uuid": "094bd7e1-2e1f-4b13-ae60-db42c64d7904", "comment": "Malware payload (Mirai)", "value": "5924e8bb083f2bd21aee263dc2c8d20b83d05accd9c2279430baf394261aa8fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080901, "uuid": "8910e1ae-e6cb-4524-a997-be3ef17157b9", "comment": "Malware payload (Mirai)", "value": "09160072d314f9aa9ec593f202573d2ff94972f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080901, "uuid": "19bc7f3f-b58f-438b-9025-4da8381e31a7", "comment": "Malware payload (Mirai)", "value": "1c0da30510b73f8997692eca9cda6fe09dc2ecceceac382c2dd36dd3ad264936a316c838b7b1b2b6b9248ac70352bf5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080901, "uuid": "f955046d-f970-4924-b7e4-5cfd3c011753", "value": "T18094D696EB412EBBC40DEE31101E47C4119D849963EB5B6BB178C45EBF8FA0E29CBD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080901, "uuid": "479d9eca-a04e-43b4-b5b7-c355384ce043", "value": "6144:TuFcpZXmu2V49kGOWBTdLlxLLK2SgHEE4z34X2/RXl3RcZchd/AY7/mJtP1lVKeB:TuFcUbP3SUbXp5EivAU/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080901, "uuid": "a4edce0f-779c-42ba-97d8-34fef480784f", "value": 430932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080901, "uuid": "fcc52855-8576-4ee4-9e59-ddfa16835b08", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080901, "uuid": "339922c0-c33e-4f7f-b815-d54ef05c6259", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b609a9-2e11-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775078868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078868, "uuid": "1ea5233a-b81a-4c16-ac37-b1a727dac10c", "comment": "Malware payload (AsyncRAT)", "value": "9c6c89d909170a8aa7a06c657f8c6c56", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078868, "uuid": "e4ef3f18-3368-4125-a717-2f0b38e95df5", "comment": "Malware payload (AsyncRAT)", "value": "59374902866a6c62f56f32bdfd15a3a3215ec8d6bd2144b111066eff58c8e998", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078868, "uuid": "7df18ed0-03a0-43a2-850b-ba5efe84583d", "comment": "Malware payload (AsyncRAT)", "value": "bc9f7bd0289df184ad8456ef34acdd85c04dee5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078868, "uuid": "2ccc7bb0-8028-4edd-8985-bf057177823e", "comment": "Malware payload (AsyncRAT)", "value": "95268ba4812fd937b2cb2f375f615ac68b66f3f7865e82bac0e2b58fdaa56554135320be35a1c24084ee69996936697d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078868, "uuid": "fab3f949-8787-4c80-a8e9-6f15ff7b51ab", "value": "T1E4836B1837E50819E1FFEFB46DE17222DA76F6235903D65F24C8428A5B27B81CE412F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078868, "uuid": "0d1ac35a-ce60-465f-b93d-c9c8460b052a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078868, "uuid": "4b35f10f-32a9-4bea-a9b1-3cec19a993f8", "value": "1536:ctfFbna531Zp+XMO13oDIY/bnLysw9mc6SxoGOz6eBada:ct9aPZcLoEY/bLhHAyGOX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078868, "uuid": "e2d3f80b-e96a-4761-8a28-f398722fa159", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078868, "uuid": "75ef7a74-703c-4afd-b8ad-d70894282f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078868, "uuid": "d90b417d-644c-4641-8808-42cfacc6b157", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaed6ed-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775080259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080259, "uuid": "fd15dccd-7e31-4313-9a75-206671369f88", "comment": "Malware payload", "value": "0b8bbf3bc7759c5791c10dabb26ed828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080259, "uuid": "3ecd7adb-e50c-4a5a-9848-2dc75f92c139", "comment": "Malware payload", "value": "5a41f498140d9418e9e0bda91364404f9f33c4f69d15732610deda7959aeb3d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080259, "uuid": "2d736394-7ebe-45cf-a4b1-9b866b341083", "comment": "Malware payload", "value": "011371dafce2587be9da9b3a24ab5272064713c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080259, "uuid": "44e0822c-e76c-477f-a3c6-33044441c109", "comment": "Malware payload", "value": "8184ffe195cc2c9e99c0bdb0c623b6bd801cd203551e01ea54ef08afbcf66882d5e1770d56c3f19d324bb05c756c0727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080259, "uuid": "dd23354b-a816-49a9-852a-33306d264119", "value": "T141F57D86B2B65364D9B7C13886E7D55BD6727C028F2499DF125CB3185AB36F00E3B328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080259, "uuid": "93f23fbc-60af-4823-8565-c3c90b8d9d1b", "value": "0db0fd22b41e519ee62086b7e02bcfa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080259, "uuid": "2db1f9fd-f3bf-4f60-a491-94a59b739cbb", "value": "49152:OxzJpwEekPQE8HX9mrWtZqW2MP3p0b7uJsv6tWKFdu9CWPTvG7UpHFhh6Dhqac9i:69XUx02Jsv6tWKFdu9CWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080259, "uuid": "05f79e38-5ed0-489d-8045-868c025ba721", "value": 3450368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080259, "uuid": "a94e8d24-4fdd-412c-b564-6133874063fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080259, "uuid": "b773d496-5e8a-4c88-9d0d-83f9b66feda7", "value": "2026.04.01.....\u6700 \u65b0 \u6587 \u4ef6 G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0754df6-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775053580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053580, "uuid": "a6568a82-5abb-45a6-b3eb-f108dc8b0cb3", "comment": "Malware payload (Formbook)", "value": "ae238667a9dc411e7b1af44742a1d2cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053580, "uuid": "8d4ed439-ff89-4faf-8115-4924f6cf0a7c", "comment": "Malware payload (Formbook)", "value": "5afe509234bf8ce2a7506274d5bdba9140889fc14dac0db2cb4cad2a4343bcc7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053580, "uuid": "f9c8c99f-fa70-4e17-bf95-dd7219267720", "comment": "Malware payload (Formbook)", "value": "9686f933dbaef66fbbceecfa40cbf97342cc363a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053580, "uuid": "e185f381-c12a-4d85-bb86-a0d377a26923", "comment": "Malware payload (Formbook)", "value": "19b9dc417b665735e5eabccd00ffee3ea313893fe5407b271e9f111a42eb9017a7191d8a9c13eafcfe4295703f8c8b94", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053580, "uuid": "807b19a2-65a6-4d3e-bd03-eab3eb4896d8", "value": "T1E054E154EFD40104FBB15E215678298A0C3B39235E2F89CE05164E8D0AFAF46E9B7B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053580, "uuid": "909e64ac-50ee-43a3-ae6e-11e5e1b1394c", "value": "6144:a0OLFzxjXc8wm1/f2HmBWtzf62o1P+SqDF/pBK/WU:WXckTBWZfrI2thC/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053580, "uuid": "ba2f6467-db26-4553-8a8d-37019147a986", "value": 278906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053580, "uuid": "6a8ac135-4439-4ef1-b2a1-2df72f9b7499", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053580, "uuid": "0beaf2d5-012a-42dc-a522-1b6d3bb48029", "value": "doc0001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab46fe-2dca-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775048439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048439, "uuid": "3ebd7a88-ce92-4944-a462-b398ea9832ba", "comment": "Malware payload (ACRStealer)", "value": "985a2349052584436e7c70117a0ed81a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048439, "uuid": "9330c932-9875-451e-bfa9-dc54c21a04cc", "comment": "Malware payload (ACRStealer)", "value": "5b0640966b086643d251381dbfe5998034a1b2b58e194924c302f93870749659", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048439, "uuid": "214275d2-c71f-4fb9-b427-d73d2dd44460", "comment": "Malware payload (ACRStealer)", "value": "fa9e3b463c148f4d52d2fb82a88ad1ab9f2f1035", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048439, "uuid": "ee869a10-ce62-4469-a92f-f61114381a32", "comment": "Malware payload (ACRStealer)", "value": "02c9fa20956b073f3151e01b485c64acd8e647884e55d4d944854a132b6dc441404e941e2a483f0293b24c44cc12cf96", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048439, "uuid": "427659be-3418-488d-8586-fbd6ea2df7bd", "value": "T147364B4BFCA219B5C4A9923485635316FAB17C091F3123DB2AF0B7652F337D01ABA764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048439, "uuid": "b7ba437b-6909-4eea-9c8a-99db195a45e4", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048439, "uuid": "463b765b-bda2-4ede-b23e-82bee22d1c8d", "value": "49152:+SNECvkfK+/YqxTpxNTc5tf+GMAq5Zk74q7Lj/Xx/9XQcl5sjGJpc:+SNN+t9g325nk7Hp9gMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775048439, "uuid": "3ec74381-4f21-4487-a3ad-d9c5efef154b", "value": 5033984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775048439, "uuid": "8d808c5d-b82d-4b11-a2c8-da082061e6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048439, "uuid": "b5150e7c-d649-427a-88e1-11962ce46b97", "value": "verificationgoogle.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb004bd3-2d96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026190, "uuid": "96496b83-47dd-4202-be51-ae1cbfd35c09", "comment": "Malware payload", "value": "37e1d0b9f568a2c6e17092c684425476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026190, "uuid": "cccafe50-923e-4b63-90ed-5e9f50541ab9", "comment": "Malware payload", "value": "5bc74e1ce5b9719d313c4327577afa68f20dd37bc3fc4acdae70b179f2d34679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026190, "uuid": "95d6da41-9517-4bfe-8a15-918c739d9734", "comment": "Malware payload", "value": "fc3e63ba1d5fd17a769e9252f8f5eabe581b1df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026190, "uuid": "3989c63e-402b-4d32-a3ea-cb26b99ee381", "comment": "Malware payload", "value": "48975394164c9cb6c94402b86567358df512a1ebbdb242a293f3f5d06569ac3d211ff77840d55ad161e38b6f4381bf96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026190, "uuid": "3e30962f-045b-4197-8497-df0197504c52", "value": "T10AA68E03EC9515E9C2E9A63189B79253BA717C451B3263D72BA0F3382F73BD06AB5710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026190, "uuid": "a3f2bc25-40a0-4954-8680-6dbfec42501f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026190, "uuid": "f1f2f7fb-ed62-4569-bc32-340e43f62a98", "value": "98304:0IYJlrC/ikojJw5SSQj8+cdaEA2b3Odj/vhZqkneH1YjS17yl21py:0I2MiVJw5Qkj3Qj/vhZveH1CSlyl26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026190, "uuid": "cacb0210-a9e6-4d71-87f6-73454289595a", "value": 9639424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026190, "uuid": "043b78e2-b8ba-48a8-ba7e-adb59e1a46bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026190, "uuid": "3c95268a-0883-4d84-8d40-723b7a9838c5", "value": "osamabinladenclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba6b160-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1775039747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039747, "uuid": "1a3e06e4-fad0-4bd0-97fc-b679e701d346", "comment": "Malware payload (DarkTortilla)", "value": "03d282095ff0c474e582e26d65ec9139", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039747, "uuid": "57b986a6-c82f-457a-a391-13225afa8a5d", "comment": "Malware payload (DarkTortilla)", "value": "5bcf71623d9092f772c0c9947db516f0867eaf818ecb5775d76fbf93a2b7de85", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039747, "uuid": "61261481-4c3b-4875-b1c0-4bf98cbeed3b", "comment": "Malware payload (DarkTortilla)", "value": "9072dea651b6d68d53db5be11dd02b94f53b07f8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039747, "uuid": "b84714e1-24e1-4ef1-8202-f8cab5f106b1", "comment": "Malware payload (DarkTortilla)", "value": "8b62fbcdddbdea775bf84c271b38db0d00ab18951ecbaee0b36226b4c122a6e934e90a9011984a7e8cfeb2edd99b6e4c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039747, "uuid": "3d56c4d6-af35-4b68-af0f-c5aa3f65bcc3", "value": "T1AFF4CF219E872F48E62D0F78C02218686BF4D82767A7E66F6FFC51A169E7F44CE07411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039747, "uuid": "354f3b9f-90a3-4b23-b76e-8b17e5feba4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039747, "uuid": "c2142070-220c-4027-9f2f-1af4b60cf170", "value": "12288:ZINV7iDG7sXsVtIZL06oImTEoF4e8cmXFUDgO2TKfHJEfM/E6P2VgBJzuPbyKOP:ZINxOoUCxIEF4Am1UB2TKf+6uVgBJ0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039747, "uuid": "7b8d63a7-69fa-4210-a1ec-cc49d3bd006f", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039747, "uuid": "ff78ad3b-3096-4235-b41a-53ad818d819c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039747, "uuid": "d38b6450-b75b-469e-9f19-01d9420707a1", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b259c33-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775038458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038458, "uuid": "6c7354b4-43ca-4c29-85c0-7d75e2834dd3", "comment": "Malware payload (Mirai)", "value": "2a35891988ee136e6b61ccaf11401e84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038458, "uuid": "9735eae9-d06a-4e0e-a9b2-0515f8eb6c13", "comment": "Malware payload (Mirai)", "value": "5c067ef70261e6ea744eb8bcedf95e8c52ad89ab1a1f0155e349b05207385da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038458, "uuid": "83fb40ff-ce26-4a18-9770-b88a3e28fe89", "comment": "Malware payload (Mirai)", "value": "40b26ce94d0b7fee80e8987869dd3676fb973879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038458, "uuid": "80ebcc83-2236-4979-9787-9af3f26bfa64", "comment": "Malware payload (Mirai)", "value": "bfa6868d8088513f34e3572a2676ea6ae141bd96116a073cc7aa7d6c517403918a1f4d29b5f2381947a94a5b7ae4f752", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038458, "uuid": "f5718b40-371d-4875-a4de-ad019f02b4ed", "value": "T1F9F2F169A62F70B4EB72A0B370288A9DD24619EAA1F4723B2C800A3DD5D500BBD75707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038458, "uuid": "581e88ce-5ede-44f8-8ce8-937214879320", "value": "768:8pxQBX9ACn0tmkFXL7Lfa0ZlafgEOIGr2PLF+kKLiFs3UozM09:8rQDAztmk/sfg5jracHLNz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038458, "uuid": "1047d6d2-d06b-4c3c-ae3c-5f16dcb69a67", "value": 34600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038458, "uuid": "9378d133-4d60-45f7-8c01-64122f77522b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038458, "uuid": "86c87b1b-cd5a-4456-ae15-72c4ff71d7be", "value": "kurayami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0cb4d-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080774, "uuid": "65470e14-1913-4347-848c-092479c275d3", "comment": "Malware payload (Mirai)", "value": "23319481362fa32f9a1486e9f2b91380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080774, "uuid": "0f7b18f1-9df7-4f3b-b3ea-45c0519c4706", "comment": "Malware payload (Mirai)", "value": "5d4f85b6a04e4f1ca86807b4ccc00292f194a2f288d2f7582c665cf6cc20905c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080774, "uuid": "72a5cc94-2ad6-4922-aa1e-d6911cb89957", "comment": "Malware payload (Mirai)", "value": "7b0e15d9004b3c4aeb306886ee2a27bd7deda8f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080774, "uuid": "e5ad3160-dbbc-4276-b0ba-100629c5eb9f", "comment": "Malware payload (Mirai)", "value": "e730fc959126ebfd2225372f8e5f186c76287a7b154348fcb9b853c3a2de2990dbbe4003535cafa434684d4bd9444072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080774, "uuid": "453c229d-c5a0-4f0e-a33c-2d9dc558e32a", "value": "T12DF2E751B8928237C1E112B9B7AE5A8E373573E8D2CBB317E82107607B8561F4E53F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080774, "uuid": "fd258978-a944-4dc3-a803-8d1c50e2fce3", "value": "768:jSL3pPJKXWnLm25RmiIu6xV/mKZhUhbyno6+w7:+1BKwRbmiIuXKXUhbyR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080774, "uuid": "53e5c917-116c-4b9a-bca2-5021fc66edcc", "value": 35960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080774, "uuid": "c906dbf4-7f58-49a6-876c-f5b39034094a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080774, "uuid": "9ebccbf5-0e5e-47ae-940d-679b8c696e98", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12ac686-2d82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775017584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017584, "uuid": "c429b894-7baf-48c7-ab80-26c88d425047", "comment": "Malware payload", "value": "e6312dc3082bbf9f1fcbec2905638b64", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017584, "uuid": "56a65633-b0bd-4d01-9981-c103d53bcd68", "comment": "Malware payload", "value": "5dfca625893c0215fd5aabc7be6dfdc7534fd579e2e72a7e58e14dbb3750097c", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017584, "uuid": "76a4c918-cb0f-49eb-83b8-8a37635bc519", "comment": "Malware payload", "value": "5e555c4bc6629a221a3df676aafd0624d17ace10", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017584, "uuid": "d19ef54b-f6a4-47a7-852a-8b667c7d1eb7", "comment": "Malware payload", "value": "0d18ae6b20f0312315aea606d2cd21b8eba4f7073555665b9697254aad922489728111e6c99446d799e99d7722276884", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017584, "uuid": "81ddb432-b65d-46f8-9300-8f08786e5cd6", "value": "T1FB24017786D93D7ED84C02F78813B470B75A0C4B8A74B1612D035BCD8D9A91E4A25AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017584, "uuid": "89555528-79bb-48fd-8ce2-12282231b411", "value": "6144:tdHxktl5lNXlEMsBkUK1pownvPo1zqA1S/dRc3X:t/ktl/NXlQBkUK1DvgdqYS/In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775017584, "uuid": "0bd9d606-fd90-4863-a948-535de32caa58", "value": 228636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775017584, "uuid": "1d16bb97-2185-4d7d-9e21-5ce63c9436e3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017584, "uuid": "22acb685-7b48-412d-8701-b9d37b5c6414", "value": "NKFZ5966PURCHASE_ORDER_SOURCE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2237e9ce-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041718, "uuid": "ef3a8d97-a5c9-4a1a-859d-1b8450ccc412", "comment": "Malware payload", "value": "8bfefb76454efe404359831d4fe7137c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041718, "uuid": "068d29d3-aa87-4d0e-8243-1e08c3c9adc4", "comment": "Malware payload", "value": "5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041718, "uuid": "3a17f761-25b6-4ff9-96f0-69effa989dfa", "comment": "Malware payload", "value": "3950fa21431ad211e1292119ff1c77e1797fa595", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041718, "uuid": "58d28d2a-86f7-405f-88f1-fdfec1348160", "comment": "Malware payload", "value": "487e811d074c164245d1cac39bec893260be22219c13b4184dca9d9d4a322afe3fbf0501143b4f367a42784dab107cf0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041718, "uuid": "1c0fd1a9-6ce0-426d-849f-d667cfcbdc08", "value": "T18F517586077F2730D491579A8D1FE056B22BC1073345E9B0B5DCE6886F8A264B2B39F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041718, "uuid": "ad549fc6-60a5-48f4-a83e-01d824187914", "value": "96:VkACd/PyTlpmUsF68uq4LDBaEscdRagRCvkRi5l25Vx/y:y/d/PvUAcdRa3voe8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041718, "uuid": "bdbd5a31-ac42-451d-bc3e-6fbbd0a42a1b", "value": 3157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041718, "uuid": "0f85127d-e0df-462c-ae02-c01c2e9b803a", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041718, "uuid": "6e74d98e-56cb-4e89-b3a3-ef52c39aa9a3", "value": "5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0b8a9e-2e1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082592, "uuid": "c88f6324-121f-4fdd-96e3-63425b445ff9", "comment": "Malware payload (Mirai)", "value": "ec8b4f185bec8300b33e0b656cc51b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082592, "uuid": "886643b7-da05-480c-aa1e-b9775bd82c81", "comment": "Malware payload (Mirai)", "value": "5e47d79677e1e860312417465398887161a70ca1b2e8d12c448c76149bb1965f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082592, "uuid": "dbb75965-847c-42d3-9191-50ece7896518", "comment": "Malware payload (Mirai)", "value": "74f3026e6b2e3ca24b4e991b68b093e0813d2540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082592, "uuid": "af75c7cf-192d-4f5a-bc15-6b3d50311c12", "comment": "Malware payload (Mirai)", "value": "e2832318643b966edd3369cf31244d4bee81d4fb27da503c8606e66400b90e270bc43b12605d101e1fa316a6db5b7d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082592, "uuid": "bdaee147-7c8c-4ba5-ae8c-cbf9403d549a", "value": "T10A33F845BD829906C6D843B7FA1E42CD331173C8E2ED7227DD157F12BBCA52B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082592, "uuid": "11b38497-80ca-4087-9a6a-c53f86921e71", "value": "1536:M/l3gcxOTLDxdTwo9SWGf26Ui9BwbZnD:Kl3gpTnzE9WGlxBwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082592, "uuid": "f09775c6-7c53-4b28-92ca-ea4a88d3a7da", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082592, "uuid": "35f31850-06fa-4fda-8745-316b88457dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082592, "uuid": "aa770e4d-8bd2-498a-a7d0-fdd981ef1668", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea31a761-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775054079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054079, "uuid": "b94a9e47-71c4-4355-95b5-3690cf8fe6be", "comment": "Malware payload (Vidar)", "value": "2cbcacf12a48e6100a590160d249a737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054079, "uuid": "4d0727ae-5e76-4d35-8061-4f90284df751", "comment": "Malware payload (Vidar)", "value": "5e5a150ad4042917e30a02f49bb48cdcaa28b765c6919785f7f75f301d294a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054079, "uuid": "fff4e172-5416-4f78-b601-6079a5d31281", "comment": "Malware payload (Vidar)", "value": "c74620491fed55af51d84926115d31769106ba28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054079, "uuid": "7f7fc1cf-dc01-4231-9fce-cec873e95455", "comment": "Malware payload (Vidar)", "value": "a71186c96c42ae0e30a2ec1fb015b427c947b842ddb8d9df879bd1f0f01524833d5c5da9a82898699fa65e62d52b63d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054079, "uuid": "6b597b29-ef1a-4643-b0c3-611331f9ad84", "value": "T1BBE41AFD9C20A326F70CD0BAE146D7538F6138011636AAA329BE93241245573DB677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054079, "uuid": "dfc63ea6-ab62-4d4a-a7fa-ee2722c0aebc", "value": "12288:oLfzHuw4M2//L39qAujwCJf/cKJ7fUYsJfKYykDZbswviGZkX:oLrHuw4ZNdujwcf/cKJ7UYsJ3nJswKGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054079, "uuid": "df853d09-d3f2-46a8-b6db-744329634856", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054079, "uuid": "4fd62e42-4692-4b0e-93bc-208ebe14ed3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054079, "uuid": "7d096236-6a73-4a12-991d-d22bf9301665", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b836cef5-2de1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775058290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058290, "uuid": "9ebc55c5-f6ec-4db4-aa3d-8bacb688dc76", "comment": "Malware payload (Mirai)", "value": "09ac624b1b467fc32ad90727036f521e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058290, "uuid": "ac667d8c-8e6c-4165-9673-d29289932502", "comment": "Malware payload (Mirai)", "value": "5efd1675908049cd4f6e5d2f39c5e3a945712e0dac4257288fb0f6fcede71ab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058290, "uuid": "7a9dd2d3-88b5-4105-8174-7c11e82448d0", "comment": "Malware payload (Mirai)", "value": "32bf47b436e17aabab1ab045a2d430d190761db7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058290, "uuid": "af9f8739-92c7-409e-808c-3c3dbbf43ef3", "comment": "Malware payload (Mirai)", "value": "489823c83aa5c5e1ccaee434a560bd19edfd47278d09071b758167b955acbf55c225ad430a74cd68598e795bf956d7e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058290, "uuid": "ffafcb20-ae25-4daf-bb09-7a510bb2f873", "value": "T165331991B8829A23C5D4137AF56E858D3B2467E8E2CF7227DD221F2037D681F0C67E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058290, "uuid": "acb1d5c1-0f83-4acc-984b-2bfef9b6a61c", "value": "768:UWrn26b8d63gaXZ2CkDd0uqAzu46EzVmndyttNL/mqXhMYUHaE9uw1:pnuaXnkDaku4Xz3tNqqxM31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775058290, "uuid": "100f4c02-7eea-4b95-9360-11a4d9c3d3fd", "value": 52804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775058290, "uuid": "62549499-d2ce-438b-94d3-d750984cbab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058290, "uuid": "8358cde2-b4dd-46d5-9a3c-31aa5d5bbf23", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3226d171-2dcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775049475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049475, "uuid": "fb417545-e41d-47e8-a24f-73e6876ff5da", "comment": "Malware payload", "value": "d6ae2724996f78555f484d268dc5c6a4", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049475, "uuid": "01758491-b888-4791-9e26-8b4528a40056", "comment": "Malware payload", "value": "5f81a3a1bb8b3c25e681fc472ddf01ecfe30d8c818e50a0d144f18e354f6ab10", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049475, "uuid": "98c6f469-de3b-42ef-bfc7-8ecfd0b74c0a", "comment": "Malware payload", "value": "4b724178ae91980505065bf64d632f4f0d214025", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049475, "uuid": "ffc96a37-cd9f-4c13-9702-70a9c1d14c90", "comment": "Malware payload", "value": "b38c1cd3533acd66aaec3b4079a0ff2c57426a9aa2939b460c98904a957ddd93c90455da5f04d3ca95707fb607c2571e", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049475, "uuid": "07f54c65-24ac-4f80-8266-6affa88a7a10", "value": "T108417992038E7DCF19A9DC68FD46A43E329BF9BD5B6176CDB15A053E83105009D8CAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049475, "uuid": "4aa277f2-162a-4082-a156-e12739c10305", "value": "48:/M0yddsfKQaftCJXOQoDTASdybsC0Aerbz/Efkc/gP4Jhx3:UAraftCEXbdksCfSna4PChd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775049475, "uuid": "7e344aa8-ac1d-46c6-8e43-48491259cafb", "value": 2087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775049475, "uuid": "abb9a84b-fb66-4140-a471-bfbffcae20b6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049475, "uuid": "9d74d818-5d6d-48f2-92f3-32e64b616e35", "value": "t.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab334e7b-2ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775056121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056121, "uuid": "d9cb7869-d526-4b8e-ac72-1cac734eb2d6", "comment": "Malware payload (Arsink)", "value": "e0d539bc76615bf7f31466ff30bf7fef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056121, "uuid": "29ff410e-3459-4f14-8a52-af3dbe73e083", "comment": "Malware payload (Arsink)", "value": "603d89c5a2883ab2ed68e12517212bd0b74760f1ef755a61d059440aeba045fd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056121, "uuid": "c3f3eb4e-5736-4b81-893e-c86cfe8d9de7", "comment": "Malware payload (Arsink)", "value": "79614555bbc01e69d3e1b071d5caee6b634bcf8c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056121, "uuid": "61e1bc4a-3812-492e-8ff8-b07cd851688e", "comment": "Malware payload (Arsink)", "value": "a05d2ddd7968d5bf810e142f8aca796e0af1a3187e482618c246a327e81a4fa229ebb343bb51f66dd7072baedeb1dfdf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056121, "uuid": "aedee042-4377-4fc8-8916-d9ef1bcaeb1b", "value": "T16E561214D7FED063ECB90731E5158F29AF18A740BA0003CBA0B3EF95675E6476C879A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056121, "uuid": "aadbcd26-bd90-4801-90e3-6b00cc02ba03", "value": "98304:JhEQmKsb6OMw4WWQKZfrYWhHPv210RgDpK03OzI+kcq1FcW:DRsb6RnDY2nZRS8qnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056121, "uuid": "b577c2dd-528a-49a5-bb27-7115560cabd4", "value": 5908646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056121, "uuid": "b9ed1da6-5650-4153-88a3-c716ec597941", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056121, "uuid": "479d2515-2844-4dfb-8c81-56700a346d68", "value": "Julieta by oliver virus .apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7b5402-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022673, "uuid": "6a0f2aff-0a6d-4dd4-8ca2-cbc2ad85e5f4", "comment": "Malware payload (Mirai)", "value": "c84a960acbccfa8818154bf057b6b852", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022673, "uuid": "93a093cc-4ecc-4c93-a758-0760891853c6", "comment": "Malware payload (Mirai)", "value": "60497d4f2b60430f0ad48b50cdaa204b0d1f429cf3874aef811a0ce2ea35121f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022673, "uuid": "28cfcb0b-e4e9-47ac-8127-895060cfb3d5", "comment": "Malware payload (Mirai)", "value": "5956ecf9c22d7acb81c4502df413dc973fc5f3f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022673, "uuid": "440a269e-3d44-48b8-a506-b7b858230693", "comment": "Malware payload (Mirai)", "value": "c902dafb4f4f9d02d67d8bc1fd0b06c6f698e99e267e57949aaf5c4ceda158713adf6f47ca9448e3a41a8c31495db594", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022673, "uuid": "62963873-b192-491b-91c6-80f798d275cd", "value": "T1F3C2D036AB49E862C2F4203ADFDDC8812F241EC7D0AD74162BF884D8A653752B1F7463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022673, "uuid": "00a92af7-f25d-4be0-bc4a-bef8df4f0004", "value": "768:jLCajzzHVVfsEBPXc7V8m0VrBKzY9q3UELth:juazNBPXcCALP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022673, "uuid": "dc24e852-9c91-407c-bc76-00dc9e6aedae", "value": 27020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022673, "uuid": "9c575cd5-aa30-40ef-aec9-b0316150325e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022673, "uuid": "89a993fa-f4d5-4ff7-a920-57fea2114caa", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3dad34-2e0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775075878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075878, "uuid": "51d0cced-67fd-45b3-a5f6-460f4e060ca3", "comment": "Malware payload", "value": "82cd959d21e984342ac8940e6cd1b3fb", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075878, "uuid": "380f4a3f-79b3-480e-befa-20c1ff060e98", "comment": "Malware payload", "value": "604e372b83ccf629c9acd3157fa6db4ae9abdb67677ed74f0e57883c2f8ce29b", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075878, "uuid": "8020a342-38f3-44b2-be03-032e83c21531", "comment": "Malware payload", "value": "7d398cfc3cf5c211b2c5732981b4bfafedd04c65", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075878, "uuid": "0cbdda1e-d99f-4637-9a32-74c9068f345b", "comment": "Malware payload", "value": "6976fb50802f432881b7230b7881bffacc7cfd66dcc971fce46195360fb1bedc2fe8bb1295961e55f01e710c6290886f", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075878, "uuid": "1824db11-3030-4dd2-8598-2db194ab9da4", "value": "T1F3263CFEF4795984EB909B30341299267BB7BB18F9255833A0D834A0ABC5E714718FF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075878, "uuid": "ebd1184e-61ac-4e2b-8724-0b6dce840aa2", "value": "abd02735f28f325b5d3eb138ccffd5ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075878, "uuid": "03aa9842-1864-4eed-ad43-98da0c5d1a9b", "value": "49152:uhjxSVuUQdBg5wA8kZH+9V/53uGfv2FrGul/kC0AtLVPDzGjffnmQgqFgcQqjJSc:uhxOe9Nlbfv4aC3IjXmQN0W8HdBaP9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075878, "uuid": "c2db8eca-d42c-423f-9095-3057fa0bb6c5", "value": 4837888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075878, "uuid": "ce650212-01d1-43dd-b6fb-64f287e02483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075878, "uuid": "2af9c51e-cf97-4e7a-a26c-b41fb682aa41", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdab2f16-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022678, "uuid": "8735e272-147f-4247-8982-2793a80cee47", "comment": "Malware payload (Mirai)", "value": "73cad07c8ac57b977d5a797627878857", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022678, "uuid": "8591d7dc-2392-47a5-9926-bd793e6586a1", "comment": "Malware payload (Mirai)", "value": "61f919f38d1244ffaa6afd556fbac3550e4e27f50fd07a84f8908d3f19eb5978", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022678, "uuid": "48350905-b630-469a-806a-cd188cbfbd55", "comment": "Malware payload (Mirai)", "value": "5e4dccb01cf1ae3bf711c1107d77523aad03b091", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022678, "uuid": "e3ec255c-4287-46b0-b841-19384a50d727", "comment": "Malware payload (Mirai)", "value": "634933bf2cec2f5ff8b2c0e3e0e7c6926365ee37706ff05e54d2f87d860cae49bc9d061704494c7b7544d0e56a6de654", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022678, "uuid": "a84036c4-264e-4734-9208-51c15d49d82e", "value": "T1AC333B21B63A1F13C0D2A87921F74B15B2B16ADE26A8C64F7D720E9FFE615406903DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022678, "uuid": "ec436e5c-00a3-41b3-ac11-446168c3cd57", "value": "768:dDoIiPlcnlRduLCeggua9rK2H8+pr/wZPJCuKqv9tPhO+QhUIAJwEG:dDJiPlcnlRduGBTa9r9H8Ar/wJtpQtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022678, "uuid": "737a914b-5446-4e4f-b5e4-9aa86c0b5164", "value": 54424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022678, "uuid": "75f6efcb-f997-4f1f-a59b-466f73e7af73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022678, "uuid": "4f99fcf2-e052-495c-ba39-869ddb3dad86", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadbec1d-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041517, "uuid": "0e9646ac-28f9-453e-8040-1fb5f53becb6", "comment": "Malware payload", "value": "46e7a5c4cf645b77f24023eef873f56f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041517, "uuid": "07374b4b-e1cd-4033-a803-94e2f376174e", "comment": "Malware payload", "value": "61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041517, "uuid": "4d0c362c-6d2b-4cbd-a790-5cce899152a5", "comment": "Malware payload", "value": "4e574710f80ada2abe7cf2ffd78f99592bb6c2c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041517, "uuid": "72f32fce-3de9-4c42-ae1f-6fc819bd3d0b", "comment": "Malware payload", "value": "8eb3a87f351cd64f8d29171dc2099d364f8643fb9e614a91d545699ea03ac97e6b4b133dbcf8f1615db7ab5f9d4da5f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041517, "uuid": "9a8bf5ff-26d9-4baa-8b46-eea41b899194", "value": "T11651966B6E735E6087B144476ACE38D6085E838AB111BAD476FD40444FED90C42F38FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041517, "uuid": "456011e2-8f56-41b0-88e0-b70bae2882b5", "value": "48:MKEAyEQh6pfVXH6i31IOav2sbG51MNcUFf0pEUbBlJ8LU3+4:Py7c5FHF2hv2JCLf0JfJ8J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041517, "uuid": "7596bd98-5cb5-4a5a-82e9-0c2f825548d1", "value": 3078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041517, "uuid": "213d28d4-6c5e-44ea-9d20-4b4307411c83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041517, "uuid": "dd578cbd-1549-4a93-9d1a-81a957a1a800", "value": "61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd60ec1-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028421, "uuid": "e7856993-13c0-476a-8a10-5855ff5f04db", "comment": "Malware payload", "value": "1ae35720f19de7c28592da4588fd2963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028421, "uuid": "27b025b0-836a-4f24-b769-ef16d213eb2d", "comment": "Malware payload", "value": "6242051c4bccec96cd7703c7387bbf31deb6fac3d8e6e0f88de287edea153653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028421, "uuid": "17d12613-922e-4987-894b-a0a1c84d0145", "comment": "Malware payload", "value": "9fe5f61634d9eb5c6a0594b736f844de10f7beed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028421, "uuid": "671077d2-c77a-4911-97dd-9c479327b2a2", "comment": "Malware payload", "value": "6b997cef1bf5b08c530875243ee01df9713de17ce8ccaf835aa17729af524b913d8ded577207eb8ac669cf6e2a3e7594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028421, "uuid": "6b0dc5b6-5d82-4967-bdd0-d6881570c75e", "value": "T18BE44A3AA3E45855E26FC27B8A838292FE727C11272092DB1550937D2737FF76A39710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028421, "uuid": "e40495e0-0236-421c-9387-6fa1d3db904d", "value": "d524f98a723098d31d30a3f757c67ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028421, "uuid": "c7ce47a8-326a-4037-a119-fa77ae8bd380", "value": "12288:XBhE8MzhZOM83q3agsFj+imZnllFywM7d6nlP4/fYF01J6XVFhXhn4JhaRebaEze:xhE8MVoMDsB+im3lFywUd6nlP4/fYF0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028421, "uuid": "012935ed-708d-415c-a16d-ceaae5197e9b", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028421, "uuid": "d529e0de-4798-4654-8e65-3bde63e73625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028421, "uuid": "5415e33a-6f66-4d6e-9faf-d0ed6fddcd14", "value": "memorydmp (3)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f63069-2e02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775072438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072438, "uuid": "bcc26bf2-27f9-4ebf-8afc-8313d4806292", "comment": "Malware payload", "value": "de0263d39f6979308320301e29866bc9", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072438, "uuid": "b3f213ef-ab3d-41ee-97bc-1e25d97c4895", "comment": "Malware payload", "value": "626bd326166a382fb884601da5e74b2e4cb299f4cb9c0059928b2f8ca439686f", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072438, "uuid": "0c834ea1-fa27-4a50-acbd-5753f8744ff3", "comment": "Malware payload", "value": "a0f220185e0b657c6caa77b3f3d1ab4222a198c7", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072438, "uuid": "b0fd25f6-7831-4444-a6a9-0c70ae58ba10", "comment": "Malware payload", "value": "9ebd2853a10a7a2905bc34d164b7dd2e14aa62702e0ce898a8448df0c0a643b68aa0ccd85c34947dfcc1ed67c4df834b", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072438, "uuid": "a0cdbef2-eeac-4329-91f1-ae081b7a8732", "value": "T16916AD23B3C40EA5C41AC934CB179F32D2B2B9924A35C1CE6769DA099EF6B507F39750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072438, "uuid": "038f7c86-8be5-49d2-acec-01ac5aaedb80", "value": "dbd1bb3c70f372dd0e928b9560e9a3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072438, "uuid": "aa4ae1e8-96f3-4bdf-8c89-6454918e7b07", "value": "98304:bx9FDy3t0OXnMBN1QQfdWAOscPNsHEUFoWrkAMZ8:bx9F+3t0O4jduNsWWWZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775072438, "uuid": "ca0865be-ae2f-438c-bd7c-9eb0f093a0ee", "value": 4313600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775072438, "uuid": "54e4514a-4fd7-4885-a3d6-693e8de2079c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072438, "uuid": "b0852c4a-08df-40f4-85b7-1d31991e6678", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78fad2d-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775035955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035955, "uuid": "fab2c836-16a5-446b-9802-b9924fba2597", "comment": "Malware payload", "value": "d7fc598f88c5abaf225ee77a2a5e0852", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035955, "uuid": "2631ce77-d877-4038-8c7e-cddff5f9687b", "comment": "Malware payload", "value": "62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035955, "uuid": "80caf4c4-cf46-4c20-b655-4dd1ca08a2e6", "comment": "Malware payload", "value": "9f831da1e656e0ef92ad26845e3230f26336e503", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035955, "uuid": "b7b6c2ca-8131-4d56-b377-26ce230666c2", "comment": "Malware payload", "value": "a598295ae62ac88d1cf54f42602ce75f606bc2f2e30651d5c82948b81d48e87b2357087c61dc496fef8fc274830adb78", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035955, "uuid": "5a0bd0fa-921d-428b-9dab-479f4ee292e4", "value": "T1C7D27089F696F4A013E7A1F4803F460BE2B3A858745B89D1E239E5D5AC7944D9033F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035955, "uuid": "e7daeacc-ceeb-4c9c-b715-e919c7da8378", "value": "384:B1ZGcx/nIMEGIbCBImKiUBjNaigxyaGvkhKYAkPdRzhUCbsm5wqah2ic5TC6+aiC:BuZMMBfLuPvhUC6Zh2Z+tgwx9/6PMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035955, "uuid": "02756da0-11d6-4d87-bf75-2471e4bc83dc", "value": 28674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035955, "uuid": "558f12c9-3740-413e-90dc-31131cb2454e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035955, "uuid": "bc21c822-be79-4568-93ae-eaba61e7a2e1", "value": "aa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e40e12b-2e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775080419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080419, "uuid": "d8868493-29f4-4caa-b34b-50fe56cd4da6", "comment": "Malware payload", "value": "13e1f8ef23af7928f8846fc7d4cedc2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080419, "uuid": "da970f1e-5bb4-49f7-8a4d-21c709d4b8eb", "comment": "Malware payload", "value": "63003891ef2a0c2901b1e21126f2c45ad68d30f1d7a791aaa1631f0b4b232aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080419, "uuid": "55f4d0ea-741c-43a5-bc74-3e70c840adc8", "comment": "Malware payload", "value": "fd3887a2b948058abfab37e1ee213bb81d5145cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080419, "uuid": "ef613d91-e1bf-429d-8daf-f541c0c4d522", "comment": "Malware payload", "value": "83c96ae83f6aa59cc5ef5ca697d38cf50e4724d4587b320d4ce060be4c90666d1c8f3aa1ee8e6493dc188a6804320d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080419, "uuid": "c31172d9-2b83-4351-8268-74466f1ce092", "value": "T1F265BE21320A62F4D91F04BB39BE6E7198AC3D3CAB06DB2A5447F73D5B738D19D62421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080419, "uuid": "2b9d2e48-9927-4609-9544-4cedf5ed8f1f", "value": "2a62b8a3a90b12d0dd43c5ca3d7652ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080419, "uuid": "7c145fdb-cf3f-4753-8a4a-0c8469649647", "value": "24576:luhCNqfWM97GZglyFU4ft8MPctx7aWMLBbRuKv3S:MhCW9umACMOuPLBLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080419, "uuid": "74603348-f863-4ba6-9139-061394faa1e7", "value": 1529856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080419, "uuid": "13b08e51-6387-4950-a9f3-ac0e53058d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080419, "uuid": "b32b148c-df60-490b-a948-7f49757c6346", "value": "\u82f9\u679c\u4e0b\u8bbe\u59075+\u8d85\u94fe\u63a5\u89e3\u51b3\u4e0d\u6263\u6b3e\u79d2\u6263\u53d1\u8d27\u6280\u5de7(23).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c385ddcb-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775050578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050578, "uuid": "e1779c44-e48f-466c-8bbb-039ed491ebd9", "comment": "Malware payload (ConnectWise)", "value": "70bad761b1a7f2d16d815e6974ca070e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050578, "uuid": "8b3d8232-22a0-4720-a167-40041daaad21", "comment": "Malware payload (ConnectWise)", "value": "639d5093a04358da92f06a5b66bd46f8eb3be5d86a6497ce3962afdddec1ce87", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050578, "uuid": "fea63616-f817-4c7a-9497-23f97b319be5", "comment": "Malware payload (ConnectWise)", "value": "f4fc2868f3d62726fd15e0b4d559828fdb70d603", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050578, "uuid": "e3941d68-8479-4e40-85cc-b761b4c2fe26", "comment": "Malware payload (ConnectWise)", "value": "b830499ec5b3f960ea895d6d053b5242c048695f5f14e6a2eee9b41a9451b8328efd8bf56716c741d909065b6b27c0b0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050578, "uuid": "ab84ff48-7ad3-4ec4-81a5-a218b8a4a473", "value": "T1E22723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050578, "uuid": "8c5b299e-5065-4e65-9a1d-a45dd34670b4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050578, "uuid": "0c2482f5-55a5-49f4-a03e-c7244e7db636", "value": "393216:Uh+OvTi7hha62f3N11fOvTi7hha62rOvTi7hha62IOvTi7hha629:Uh+Ovjf371fOvjrOvjIOvj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050578, "uuid": "c690baac-3c90-4e7c-85ae-7241c97f2702", "value": 20511288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050578, "uuid": "2e145ed1-c04d-4be4-b80b-1083008a1127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050578, "uuid": "29e8e406-2ecd-4496-9dc3-aac3956130ff", "value": "ScreenConnect.ClientSetup3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52370c94-2e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775083030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083030, "uuid": "f8e124a9-78c9-4036-8430-a6953d9217b9", "comment": "Malware payload (RustyStealer)", "value": "7cc9f325316b3dabf3788c14ef2b81c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083030, "uuid": "68ee1421-b6d4-42e6-aa5f-b8d882418a3b", "comment": "Malware payload (RustyStealer)", "value": "63e726bee554a09ad7de1f8303928850b94174a8e8828c224b9d9c54dc1b2656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083030, "uuid": "3985ae62-9e91-4378-8b69-b1fc23d847c4", "comment": "Malware payload (RustyStealer)", "value": "cdc2dc64328bf7ea05494a9302540918bd84813b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083030, "uuid": "f66e54bf-224e-453d-b7bc-6ddb006d4592", "comment": "Malware payload (RustyStealer)", "value": "21681e25c87b83154053bdafdd91f1a83d351dbb39c5fa2907ea4838de2d212c3c3372de9e6b818300292329dbfaac06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083030, "uuid": "ea2cd4e0-6590-4027-874d-04a28bc9b7b0", "value": "T1AC76CFB536187CF6EA3E4377DA666C9D13762362479794CE107072C20B43AB9FE26C48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083030, "uuid": "1220f8e2-cbd5-4e3e-807f-aca00a5d44ae", "value": "eefd3e807372dbb1c86439f17e5cdd16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083030, "uuid": "2ff66433-2f5c-41c4-abd0-0243793e177b", "value": "24576:HevYUZBIvAKgCbKErHsEtvzJHtx10zDaDRrVsaoAnNAWtG1t+sGA8i+jLoQpQkOj:HevYUjIYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083030, "uuid": "c0127f6c-0568-412b-8f81-52d303f772c1", "value": 7219785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083030, "uuid": "b5edef5c-d966-4c5e-8c42-c6615182eacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083030, "uuid": "95a3e6a7-1436-41e0-bcf1-b4a1e7c61b91", "value": "259UZDS8POXH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee16aa0-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022760, "uuid": "74c6812f-568d-4235-8b34-a6dc4a0de57a", "comment": "Malware payload (Mirai)", "value": "f25208f22c4c234dfe3040bc7fc3b71a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022760, "uuid": "3419cb74-3200-40c4-9c93-9681838b2cf0", "comment": "Malware payload (Mirai)", "value": "643428561a460b3834be43723d672326f6b0e289a639b26082d0dc4295b05656", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022760, "uuid": "40a93ae6-b68a-413b-9258-6b08947deb5b", "comment": "Malware payload (Mirai)", "value": "6b97cda97e030653206c66d12a05619f342291c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022760, "uuid": "6c674bc6-3920-4023-8dc5-bc5136443b30", "comment": "Malware payload (Mirai)", "value": "6adadb8d88bbd97ae0348367f99d6c6dbea6f673f32f4968228e4c2f1a45f46382ca7118823ec5f1a6ba72fbf03e3f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022760, "uuid": "d22e95ad-8115-49f2-87a2-8b1238a4993f", "value": "T1BA23E792B8825A27C1E0237AF5BE968D336077E5D2CB7227CD610B647BC251F0D66F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022760, "uuid": "1f9d6534-0021-45b9-89b8-01cc0179aa36", "value": "768:klvPK+Y8s4d7Wa6kVWZIyWVxexZQh2TRb9RtYmEu7dGoXKrwExi:Yy39kV1yWPe3XTRb9neo60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022760, "uuid": "193876a3-4b53-48d7-b1e6-b355b39e431e", "value": 46284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022760, "uuid": "5b7f8182-a9ef-4769-9936-21811fec1f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022760, "uuid": "7cc73d59-f94a-4bb0-9c98-59d31cf5ab6e", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b93bce-2e0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775075629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075629, "uuid": "0da01e75-e77d-4f09-b54b-02b8c8b305e8", "comment": "Malware payload", "value": "7f79b66b9bb5099415224be7ac33fb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075629, "uuid": "e3500bd5-e90d-44ae-ac61-76dad116e0d3", "comment": "Malware payload", "value": "6437c30cb1a5d692f9aa0b1614b7889a01313c7bf9de788ced4de3652bf901d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075629, "uuid": "8916e469-afd4-4006-860c-95d1db2b2533", "comment": "Malware payload", "value": "919452142afa1b6ec8dc55ad5264b00fb9a9c191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775075629, "uuid": "4d2a392c-0399-4d7f-b0c5-02c281f20304", "comment": "Malware payload", "value": "2508907ad78fda841ff8dc65d6b58f156c16b79124ea6f106ba55047c5722a982987c9899db4937289041d6f364013b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075629, "uuid": "8f964bab-b8ae-4baf-88bd-f65198399c0c", "value": "T1C626239FA7BCCC1CEBC4E6B26527DEF508339611580B6F922DE421758271D928ED10AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075629, "uuid": "87c7e94d-1059-4ffa-b2f3-dbd87d7460bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075629, "uuid": "af911f8e-d70a-424a-b9fc-48cd1e1f517b", "value": "12288:LGhsgwdIMvh+BjuYlJWY9+GBcDWiqGJAZZs:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775075629, "uuid": "2216a57e-0008-4105-848d-d9d641814a4a", "value": 4506112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775075629, "uuid": "02db84f2-0e45-4d71-8db9-6b6ff14c66be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775075629, "uuid": "6d9fbc0b-edb3-4682-a0fd-d2177d3649c1", "value": "mjxbqxyyfh4boly9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b8649d-2dd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775054144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054144, "uuid": "53073365-8c6c-433c-8ea9-59175b16734c", "comment": "Malware payload (Vidar)", "value": "30e3db06276d8615fcbc5a29fc76b0fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054144, "uuid": "18b4174d-0a56-4e87-9e03-e5507997706f", "comment": "Malware payload (Vidar)", "value": "644f455ea3df3e1b1ca80aa36336a4fcf439addd35e097f870e83b35031a23cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054144, "uuid": "1e410c77-0740-4a91-aef6-57176223e776", "comment": "Malware payload (Vidar)", "value": "4868e9db58af3b9cc4b1aad91fca106f96fdf834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054144, "uuid": "0d0006a1-487c-4c70-836a-14996524fbd7", "comment": "Malware payload (Vidar)", "value": "dc187277787575753e40751b5a650ef399d3cfe817b0c56561cf02fb34b5d2ab4e3ec4e893404280847d6a6556deefca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054144, "uuid": "42e00b0e-ab91-4832-9425-4ddd373a680b", "value": "T13DD42BBDAD10E336F60CD0BAE282D7528F213804123A75A719BD97241246973DB677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054144, "uuid": "6e0e8d42-3c23-4a42-bb9a-84986c8318bb", "value": "12288:Ny0Yj34rhLooycHr2BIEDJvnhKaMG01W/KD8XV339S:NNYD4rhLbxHr6DJvhKaP01kXV339", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054144, "uuid": "791d006d-754c-4cd0-af30-28ab0380d6a7", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054144, "uuid": "54b2c317-54e8-43df-a804-1f8f1731af2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054144, "uuid": "a83c0ef5-6791-4c0f-9089-e5e5ee2b2376", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a751d0-2da7-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775033135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033135, "uuid": "8bfc83c6-d67d-4943-bf2d-093ce55424aa", "comment": "Malware payload (DCRat)", "value": "e8546f68a01449ff15144c8b6384c046", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033135, "uuid": "a6eb3e62-3992-4b13-8b92-35f861368150", "comment": "Malware payload (DCRat)", "value": "65e5b34667cda5e4444f563750beb579a8e532f94bcb073222c77fd16e9545dd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033135, "uuid": "c1908c66-55a4-4ad9-8b34-0614c2018da6", "comment": "Malware payload (DCRat)", "value": "831a0fdfc34f3d1ea678a6de54d73dd754abd7ce", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033135, "uuid": "1df490fb-4248-4137-886e-1cf24b726fe5", "comment": "Malware payload (DCRat)", "value": "2b1a59c9eeb8ae22d8aff448347db5c537bb045981e46e2e90a92708a7c468d5c5f64b15387180844ccc573098d8de41", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033135, "uuid": "f1e14a5a-6df4-4901-bd3f-ad3c700d870c", "value": "T1C04549027F548A11F1181237D2EF850847B4EC512AAAE72B7EBE376D95123937C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033135, "uuid": "9a0969f3-f658-4f67-93ba-c7ec955486ca", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033135, "uuid": "0cebe4ff-a62e-48da-84e6-20ae7fe85d7f", "value": "24576:U2G/nvxW3Ww0tDLrA9aWR17wrNDkk+zFkT3wc:UbA30DLs9bMTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775033135, "uuid": "6af9e2e9-fca6-4587-808e-1d5c876603bd", "value": 1167019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775033135, "uuid": "afbd6619-2a6e-4f40-8012-052b2e5bb774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033135, "uuid": "2a2f19b7-494d-456c-9145-bf25a17df9e3", "value": "mam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b1bab4-2d9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028329, "uuid": "415332f7-66e1-42ee-8031-80e377ddb32d", "comment": "Malware payload", "value": "5cb81b3bc5d90d1565776143785e4c99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028329, "uuid": "0aa52e67-8e74-41af-accc-e9ed707323da", "comment": "Malware payload", "value": "6601cc35931924371842d26b6ac6abd770b1924916e0fd10756a61dcf8afd882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028329, "uuid": "47f1eef0-4bf6-44a5-a221-488b6198f773", "comment": "Malware payload", "value": "dbcc3e59d8d5dcc63e0b85ac62c4d495da05b043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028329, "uuid": "b58d3a4f-3352-408b-adf1-935f2d5639b7", "comment": "Malware payload", "value": "057c17ccb4e2b37f266b2898f2725c65e2b9751d237c6aed0785751c661e43c59e7c96658cd5c1524c106771db02cce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028329, "uuid": "d3f0b7bc-10bd-4b77-8b2f-5b22b9c4b624", "value": "T15305FA7E5963912ADA9A80FC24554B625971B33B03B41FF301669130371BAB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028329, "uuid": "1782b11b-7a35-454b-85c3-78be5b26b8a0", "value": "12288:3PVcBkon9A/7DW7VkJmHX5wMFGLl4hlDFWpIfk+xr+8ZU9ooR4Ig6:37Ew76CmHXlNkqxr5U9b26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028329, "uuid": "d00e6a88-4c51-49f3-8b46-eb7d5b9336b4", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028329, "uuid": "b5aae448-bcc6-490c-9e71-2d66ae7aab95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028329, "uuid": "b84d1e00-dedc-406a-b797-3a4c73243165", "value": "memorydmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4043dbfc-2e1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082570, "uuid": "d9d3d491-66b7-45e6-93a1-d02cf3418d84", "comment": "Malware payload (Mirai)", "value": "d435779e6ed05188b646b4822f433746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082570, "uuid": "17c6e4cc-c1f7-474d-b155-df9fb901fd7c", "comment": "Malware payload (Mirai)", "value": "661921358ddded1986e5b62293e3d6ff510fc603ebcec7a8d5ba3d3acd8f47ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082570, "uuid": "f7c354fc-a4bb-41b7-8ac9-125feddbaa78", "comment": "Malware payload (Mirai)", "value": "92637e41c28303974fb55f675ff2c24bbf7490ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082570, "uuid": "74459b99-18c4-4d39-b228-761666e9ea1d", "comment": "Malware payload (Mirai)", "value": "aafa7468e47ae8755dbe33ae00ea76a67147f90cdd9cc3cfbdd0284e503f3517b35c6d648fe502ef462f1e866cf0fefc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082570, "uuid": "e6e906e1-a579-432f-803b-6eba180861a2", "value": "T189F2F951B8928237C1D512B9B7AF5A8E377173E8D2CBB317D82107607B8161F4E62F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082570, "uuid": "3fe34187-8ec4-460d-a4bf-f4c70a8553a4", "value": "768:JhLEqGKX31qBHA0G5WyO1K/0d09/acgobNw7:vSKVCfG5Wyf8m9/acG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082570, "uuid": "3b4f07af-d442-4968-9d37-1ef345bf1360", "value": 35980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082570, "uuid": "0b302dcb-aa5f-44fb-a568-6b8fb098c59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082570, "uuid": "4b919521-bf0e-4f70-b4fd-44630270a3e8", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144266f1-2dc8-11f1-a769-42010a9c0008", "comment": "Malware payload (BumbleBee)", "timestamp": 1775047278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775047278, "uuid": "00d0c722-c8a3-4fd2-9426-02f86472df79", "comment": "Malware payload (BumbleBee)", "value": "a2c54c9b26b8e4f99809ed2045b53d52", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Duohanbeiwei-Network-Co-Ltd", "colour": "#9CC3DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775047278, "uuid": "0e1927a3-6ea5-4ccd-9de5-9a411260eba4", "comment": "Malware payload (BumbleBee)", "value": "670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Duohanbeiwei-Network-Co-Ltd", "colour": "#9CC3DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775047278, "uuid": "588ac108-7298-4699-bc30-376d8833c7d9", "comment": "Malware payload (BumbleBee)", "value": "82fd2f5e0d45780f53ea424fe935cfc1bc4cfaac", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Duohanbeiwei-Network-Co-Ltd", "colour": "#9CC3DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775047278, "uuid": "a595b916-404c-46d0-b90d-07ca3fb77079", "comment": "Malware payload (BumbleBee)", "value": "a59c2366e0e7f7013368017db8c9d6e4eb27637afa07e40ddb8ccd35e4debf464262a6d1a8af6fae42f128f68c193451", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Duohanbeiwei-Network-Co-Ltd", "colour": "#9CC3DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775047278, "uuid": "11f0afcd-968c-4d22-9996-0fc7c6755097", "value": "T1C68533A47E0E90C9EA8AC8FA34D15F0E95FDFB5EF6BC81031150833D5A635178E8A91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775047278, "uuid": "de4840b0-6d17-4b17-8512-af8934f8bf72", "value": "81b5a68eca3e2b0177f7939b4a1781a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775047278, "uuid": "62236a40-db18-4e29-a112-404456032836", "value": "49152:D8Q1LptohcpwEWUtnKCofGxa8ZHGnuIKwVMN8U:wQ1Lc0wjUtjxrGnnKwVS8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775047278, "uuid": "fa6debe7-4cf8-49eb-afe8-ac4dcf338c9d", "value": 1852656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775047278, "uuid": "f1d52092-1482-4d34-911b-bcc7a1000564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775047278, "uuid": "2e935a02-54c9-437a-930b-8f5f950752b1", "value": "670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fe42b3-2e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775081504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081504, "uuid": "d73ce6ec-9c2d-41ce-81a8-e1104dfbce3f", "comment": "Malware payload (Mirai)", "value": "75aa740fa3ce591c164fe84f9bbfe05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081504, "uuid": "26259a8b-0e1b-42ea-b16b-b8a694216883", "comment": "Malware payload (Mirai)", "value": "6714e4a1dfd9eef9f5eb7d75629b942316011ec56d8a5b7360b9903a9247236e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081504, "uuid": "ba8108e7-4910-4ffe-ace6-1f5aa1f0a747", "comment": "Malware payload (Mirai)", "value": "919a8fcf61f9549bc4aec388d6a798ba969ec63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081504, "uuid": "c7912179-7307-4199-ab3a-667572102e83", "comment": "Malware payload (Mirai)", "value": "33a8ffcf3101af705727607308b70e09faaef8948231d09c7ca52f9e052871ab653ad5e6bb568ff5632570ff1bd098eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081504, "uuid": "e8f4e80a-440f-4976-a80f-4cce6ab78543", "value": "T1F063410ABF611EF7F86FCD3706E52B49308C601A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081504, "uuid": "079512c5-2259-46a3-862e-8f9c09f91b77", "value": "1536:nxo6M86eAtqVedfWVNufYuI0Kck6n2MFiwbZn:K6MjeAt8eVWhulKV6nkwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775081504, "uuid": "aa1b7526-e43c-41f8-b097-74862b337341", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775081504, "uuid": "cf9230fd-cdd3-4dbc-9f5b-bf1e65a77acf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081504, "uuid": "bfe934f3-9549-4dd6-acc4-2ee75bb9acff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cdf836-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057769, "uuid": "b3e33fb8-39de-4a88-be67-9aab6f6248a7", "comment": "Malware payload", "value": "38c5bcfbad58300f072df33e406de906", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057769, "uuid": "3465bfb6-2382-4a9e-b1f6-2fc603613673", "comment": "Malware payload", "value": "6782be92446949f1cfc440be15c8f4ccce85ce682724da2ddf6126c23150a605", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057769, "uuid": "4faaf176-f083-499d-b2cf-e269b0bb6040", "comment": "Malware payload", "value": "b5035b947e112b3b9e73e6aac66e74aae4883ff6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057769, "uuid": "d3115c81-7fc7-4767-8d55-d5d6ef83c7e4", "comment": "Malware payload", "value": "f5a51c34dec853ea973f7d46671d2f17050a8a8724e07f34eca6aed2345d047ca387efb2ff9101efa58ae881885908a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057769, "uuid": "ef5f4882-5728-490b-8e29-5f255d3f02c7", "value": "T10EF26488B6DFF258164A30A32C67B053B57DCC88BD1C8554F6E2A9ACFC6C304D56A97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057769, "uuid": "914f5d66-3852-4824-b922-cdfe0f5027de", "value": "768:Vunl5qFmlZ8AVSQUBZOQNuTqYZtYtnuIyVFeSkz78XMDco312323:IIFmEAVSQUBZITHZt8uIyVFfkz78XwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057769, "uuid": "67e77cdc-4d98-415c-8707-f5125248afe9", "value": 35009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057769, "uuid": "1c3ad9ed-2433-46e4-8763-96435ffe201c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057769, "uuid": "2f06bdd5-53fa-4fe4-91db-3f2f533befbc", "value": "Final Technical Drawing.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cf6926-2daf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036736, "uuid": "7a438db5-d706-46b1-b652-f41ec45656c3", "comment": "Malware payload (Mirai)", "value": "8f6d2db4b8f2c0f7d3c27d3fe1227942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036736, "uuid": "75866926-f679-41e1-aa71-a1cd2915083a", "comment": "Malware payload (Mirai)", "value": "679f25235efbf8382f41613c5192b690dc61ea9972dc57d087c19418bb3c19ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036736, "uuid": "8db0f5cb-e891-479d-8461-e2e3f78444ee", "comment": "Malware payload (Mirai)", "value": "ad83937bb9173ca3b4041d65dc24a81379776059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036736, "uuid": "5e9f09f0-3cd3-482e-aee3-412025e767c8", "comment": "Malware payload (Mirai)", "value": "fe3dd8f8070532c9c3f74dcc8a7683fc81fc02ae79494972310413294e99fa5af76170eaf53040b810f24bb6578e59bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036736, "uuid": "99cd33f0-1019-4286-b69d-ecb2ad08fd7a", "value": "T177343B86EA814A13C4D627BEF69F424933339754D3EB720299296FB0378779E0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036736, "uuid": "325ddbc8-3b2d-47b0-9f1d-bfe271dbe598", "value": "6144:eGRS39fG63T7t+d1NOaOUUJ8YaUfROh416rsGM/RmReP:eGRS863Ty1NOaOUUJ8Y5Z/isf/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036736, "uuid": "34ce70db-9d8f-4818-b18a-006756ef7d58", "value": 242076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036736, "uuid": "551d5c07-48fa-4226-bf99-e6a37eb3da47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036736, "uuid": "60551338-2061-4ba6-829d-c6cc09e67f50", "value": "kurayami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6b6fb4-2d97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026273, "uuid": "4b263480-3ee9-47f3-bf6c-3bb4f238ea4e", "comment": "Malware payload", "value": "3b9788369a38e93d07b5599ca0a655a7", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026273, "uuid": "99ea8309-f87d-49cd-8aed-be5ee8e52e4e", "comment": "Malware payload", "value": "67c6c927c4ea90c88c710bed90e71403c36c2de29100c197d7bbd5a8cde1ed24", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026273, "uuid": "c4a7ec3a-a89b-437e-b238-0f13fa423c1d", "comment": "Malware payload", "value": "3f6b1f11b946ef00301e683085df85fe30f9c0e2", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026273, "uuid": "b38e5053-e9e6-468f-b66e-7dfd4aab8738", "comment": "Malware payload", "value": "819775be333cebb954e08a5c32906c76d13943bb9f16c0d3096b849b966103ea75fc003b4009ea1bb3cc16870a6d0567", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026273, "uuid": "4fff5553-27a9-4f3e-9fe4-c5705ba1eea4", "value": "T17E2401B795D5BD7EC88C06F748A3B5B0F24A5D0B8970B0A13A035BCD8D9940E4619AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026273, "uuid": "ba98f4d5-94e4-488d-afac-3e2709da03d4", "value": "6144:wAHxktl5lNXlEMsBkUK1pownvPo1zlAX51EpjeSx5p:w2ktl/NXlQBkUK1DvgdlAKjeA5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026273, "uuid": "7569527b-5af8-49e7-b642-d64620db52a7", "value": 228608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026273, "uuid": "2ac5a9d2-7194-4a15-b9db-119a2519af48", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026273, "uuid": "afca3e57-30df-451b-b433-ac03df27d725", "value": "Exploit.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f38988-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775063813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063813, "uuid": "ef799d22-8a13-4126-a7ad-3b847e871a56", "comment": "Malware payload", "value": "82c8cd09eceae01837484fd77b8b0426", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063813, "uuid": "30ae79b7-f489-445b-b60b-6574c710ea08", "comment": "Malware payload", "value": "687f0be5399d54a1b841fdae68c75d2e46dd12f1c76f14687da58222191bbb08", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063813, "uuid": "ff91ef7c-aa57-424a-a49e-93d548ddfea2", "comment": "Malware payload", "value": "ffed380e64fcce6179729c55d3fe2ec5fb69f265", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063813, "uuid": "0b670d0f-2cb3-4c42-b215-29ed9e46e2e7", "comment": "Malware payload", "value": "4e0e8588088459f36761ff47fec7de0922ec6194ae8e2b8a6839a367698dcb2463d443db33b7af00854bf2ed448cad8f", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063813, "uuid": "d0140a8b-8aeb-40a1-88c0-91681939158e", "value": "T1DAE63322832AE455DD736B7938BFC30AD52EC5993B06B5CF2EF60A686C856D0431B70D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063813, "uuid": "863d447d-daf9-4475-8ab4-e71c4d7dcacd", "value": "196608:ASNI3rg2DDB28b2cUk2tf6/o67mLrOLFjQR6Hs5JqNx3Q8SDUYdDOGAXUR4JhmsC:MbDVHb2crwi1mL0tEHUx3Q8SDUs4E8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063813, "uuid": "1f033183-6f77-4330-b19d-c93a85ea014a", "value": 14311881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063813, "uuid": "a2376a86-2b20-4d2d-a30c-defbf4ef6bbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063813, "uuid": "e38c298e-523f-47ff-8bc3-8ab1310eccf2", "value": "697339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daae4bb7-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1775041168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041168, "uuid": "b376244e-fc09-4222-90b4-45af268ab88d", "comment": "Malware payload (SantaStealer)", "value": "232d066a3caa5cce50d3549c537f328c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041168, "uuid": "ae86d373-0f2c-427b-b97c-c40d42a6cbf6", "comment": "Malware payload (SantaStealer)", "value": "6890fa7e599e49cbb5f70c9fec4595da83b512ff0cdcd9be120edf322968902a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041168, "uuid": "6e5953f7-a98e-43fe-bce1-0875ad31be7e", "comment": "Malware payload (SantaStealer)", "value": "4042df59d9de684cf0b19314c20a9cac2faf27be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041168, "uuid": "114c5efa-fd31-4fe4-a0d7-5600a7c79f9d", "comment": "Malware payload (SantaStealer)", "value": "ffad960f2d457683a9c2e59256261764d74956a9b99edcb7af2e2db6e8e2c04b3db719c2b3ccd2e7ca2e4e37c458732e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041168, "uuid": "b5f6c721-0bb9-4794-b27f-2360e7d3002e", "value": "T1EE76D0CAD16B40D6CC067FF598142BC39B3056324A34046836BBBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041168, "uuid": "4033573e-4b85-44bc-9070-a80d4f7dc108", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041168, "uuid": "562e0e0c-b6f4-4c06-a8d4-08b805257c6e", "value": "24576:GqV/tToXCu0pmaL6EerPAX4VhEl0Ju8Kqrcj/jUhf6uEHgnODhbigb45HF54JfDJ:Cb0tsNayt2CBudctssago8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041168, "uuid": "ed0591c2-2b68-4d84-8908-0964905e1101", "value": 7222272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041168, "uuid": "4abb546b-9eb7-4c4e-9344-155a2792703c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041168, "uuid": "0c973169-bc2d-46cc-8be5-ab7d3f731c2a", "value": "MOD_MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f24d0dd-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775028559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028559, "uuid": "dd33a039-5800-4d04-96b1-39033bab5e8b", "comment": "Malware payload (ACRStealer)", "value": "616a34f76ad4edbf7667d1f46bbcda4f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028559, "uuid": "51ace7f6-d07f-4775-997c-c9ec86ce82ab", "comment": "Malware payload (ACRStealer)", "value": "68e47e20011cd303284737ff3cdba23527ecaa2a39df924edd2e749291c80f11", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028559, "uuid": "6950f0a0-1d35-43e4-887c-079617a00c73", "comment": "Malware payload (ACRStealer)", "value": "ff666aaa681b4d94d198d1937f305f071d3b52e9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028559, "uuid": "5198e618-0ebe-4fe4-b6a9-8c921eee69e1", "comment": "Malware payload (ACRStealer)", "value": "def28c6753112c49e18f42c266822a6db9070157c2a6401dddfb569008540d46dfbed3bfa6375a35e6d01ffe24e04a69", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028559, "uuid": "09001d3c-aa9b-4b01-9f48-d7fe5260eb13", "value": "T192365A4BFCA258F4C4A9923489675256BAB17C051F3123DB2AA1F3741F337E01EB6768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028559, "uuid": "833cdb61-6b54-46be-a24a-ca83ffa904e6", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028559, "uuid": "97b9ae9b-a8f5-4dce-a46f-6d244116ab96", "value": "49152:/PxacdaJb6UuPG0sfqf7ExSsURy/cW6KQx3ADBljnnJFQclAlLpcL:/PJC7kExQ510", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028559, "uuid": "d7528604-37e3-499c-a5e0-ee3144832498", "value": 5125632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028559, "uuid": "e8f1f6c4-b3dd-4ee6-8a99-9e7f19687d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028559, "uuid": "028e345f-cd90-4e31-9f91-9921ccc06b18", "value": "SecuriteInfo.com.Win64.MalwareX-gen.14737686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4607e2ed-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041778, "uuid": "1dcf5377-4500-4c01-9871-2cfb9952b2f9", "comment": "Malware payload (Vidar)", "value": "08076390363bce47249033d6c2d47529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041778, "uuid": "6c3137d9-5151-4267-a69b-988ef631c777", "comment": "Malware payload (Vidar)", "value": "69088efae6836ea23178fdb3969f86669d501a7de8e080b5eb18c514fedeb6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041778, "uuid": "33ff3b1b-a80e-4b50-99b8-89fad06b3698", "comment": "Malware payload (Vidar)", "value": "849f7534fc39c597b1e1bbb819f072c96b2440c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041778, "uuid": "36c7bb1e-07d3-426b-8c02-693f44bdb1d4", "comment": "Malware payload (Vidar)", "value": "66e4c4391ed60f0941aa3e9e76dcc576eb460c9fb3fdaa1ffdab30cc541c7814748cc5862cc7d0f0c40f0163910eaf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041778, "uuid": "7af81bc1-c5f4-4ad7-a14d-58e7899ee40a", "value": "T10D47E193EE540776C69BA33AD9E252462330F544073224D7BA9427564D2BBC81B3FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041778, "uuid": "f741e611-33c4-4a34-ad72-cb2bbdba858f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041778, "uuid": "f2317e3f-03a2-44b8-a41b-60d3699eac1f", "value": "393216:G4Cz0r2XffF01xsZeNTznX+y14iuRP1B2XjulL3:GtQr2XfdM1hznbmiw2XQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041778, "uuid": "2e29daae-4575-4f56-a526-ff717ecdf849", "value": 26753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041778, "uuid": "671b4737-3034-4440-a15d-94f324b3b4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041778, "uuid": "a265d5cb-b04f-46d3-af37-2c7c2e68ed87", "value": "Nexus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63b0ee6-2df4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066474, "uuid": "52e8019f-16ac-4987-92bb-15775dc62efe", "comment": "Malware payload", "value": "a54cc121988e2ad46204acff7903d101", "object_relation": "md5", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066474, "uuid": "9c10c26d-88ae-441d-ac8b-b1810ee6bff0", "comment": "Malware payload", "value": "6b1e4f63bb95a972044d1c0452e87f9ea5d878241332475bd04c3b0c3950e22f", "object_relation": "sha256", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066474, "uuid": "58366366-9d86-46b0-a94e-935d8b676ca6", "comment": "Malware payload", "value": "a39ccfb40c29768823fd100ee031dc7e7d579b00", "object_relation": "sha1", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066474, "uuid": "181f314a-ac90-4fe8-80c9-ba8071f46474", "comment": "Malware payload", "value": "b92cf2b8b173145afc4145db851cce00da82766f0be55ef028502e3aefbbc18862ce19dc0fdfdedf417b13799a68953c", "object_relation": "sha3-384", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066474, "uuid": "1a12b313-8665-4d27-bea2-c0d8c8a22806", "value": "T1E3C633D8AAB0C5E6768126423F862DBC7F6085613FD49547DB821211E63FB88CED6C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066474, "uuid": "0f018f2c-5103-441f-8b24-3c564c9e432c", "value": "393216:DH/dtM5tNsei5RtpbDlzmeXZZeqTYmH7a:bPUseYpAeXZvYmH7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066474, "uuid": "8ebc087b-7443-48fa-afd6-4d033238d89f", "value": 12591196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066474, "uuid": "f614677e-fbad-4c07-9988-49d6741bb331", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066474, "uuid": "278e610e-4433-4b62-a392-4ae9c8154a33", "value": "TLG_po_GSM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a17fa3f-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039342, "uuid": "94f31729-ee79-424d-a14a-99ae9990e565", "comment": "Malware payload", "value": "6a8bb543b3d7e2e193e472161f7740ae", "object_relation": "md5", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039342, "uuid": "c7331212-67b9-42ee-811f-5468852d1634", "comment": "Malware payload", "value": "6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e", "object_relation": "sha256", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039342, "uuid": "f79ed0ca-0e5e-447c-b8a3-67127cb64420", "comment": "Malware payload", "value": "f1990fadb8b67c52859474dfde448462e9ebb60e", "object_relation": "sha1", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039342, "uuid": "1ae48f36-2cbd-4509-a85d-1d5625cd909b", "comment": "Malware payload", "value": "3a1cd20c70ed7f9a60311ad61b131f0f16201426afe3ab17b607099647363ae1b3ca5e2bb66cf6b51a6ddb552f284b76", "object_relation": "sha3-384", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039342, "uuid": "17185e84-8a92-4a0b-a8e1-fb37cdc5839c", "value": "T1380110FE783234B25F43C5EA9D5394970976D36F5FD02DAC28E6873414AE010A13222D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039342, "uuid": "6a7fce39-22c4-45b1-bae6-f04c90410354", "value": "12:Sjly97dG3BCFrCR5Va7hFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:OUxdGxCFmkt1EDlgNjTidGXhGIBFVR9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039342, "uuid": "ba0cdead-2743-4d01-9e9c-239c3bcd495c", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039342, "uuid": "0fe8d6e2-13b2-4473-83cd-a634cebbc4f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039342, "uuid": "e6ad5177-67fc-4ccc-b94b-c668164bab39", "value": "6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a62dcc7-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775060334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060334, "uuid": "e5bdafc7-dc4d-48fd-9c3b-b98d3fcf2f60", "comment": "Malware payload", "value": "1e8179b41f48818073567837b276fa40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060334, "uuid": "1eb609f2-97f3-45e3-8be5-32fd120f868b", "comment": "Malware payload", "value": "6c0647bd0ef2abe54ac55f849332d37c289e26cdeecda47a2edf6164219de153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060334, "uuid": "b8564d0e-67fc-4d0e-93bc-7a71b033df42", "comment": "Malware payload", "value": "7adfed7f890ee408b2fc54c69ab9794d1915150b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060334, "uuid": "82b327ef-5a09-4156-8e52-ad0928e357a4", "comment": "Malware payload", "value": "7ae8e3881992f5147f0a43a72f763bf3ce0a608315774c4aa0993a13e15815d3fddeabebb34fdd4a466ce58a015cb42f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060334, "uuid": "b0576ffd-65cf-4819-ab2d-18ca3705c3cc", "value": "T1E3F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060334, "uuid": "7e9358d2-3e33-44cc-8e9f-d6609413c08e", "value": "1536:4Fj0K0cbqDHavMLDtr88VRVk4b1Y7gygmnP7Dy+4fMJrEn5p5M/LW:vVDtrTVXi7RgmP7DyrfMJrxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060334, "uuid": "0fa4afc9-0a7c-4fe1-9ddf-a9cfb212e6cd", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060334, "uuid": "324db063-8384-48ee-a1ed-ca193eab530c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060334, "uuid": "71c1e735-05a4-4fb3-8a6c-6d6f90275925", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eae988-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775035974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035974, "uuid": "955cb24b-5a40-4aa0-955d-e7519281641a", "comment": "Malware payload", "value": "8c0e7e04f3d256585437fb9d223c4a71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035974, "uuid": "2d35fd7c-5b84-4a32-8c81-9cc937e68df2", "comment": "Malware payload", "value": "6c7042bec02813c80206d9589f360006f47f9efed163e173c2b36659d793cfa7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035974, "uuid": "4c410ae7-b9e1-417a-8471-d4ee04c6fcb5", "comment": "Malware payload", "value": "fbd742bd17a183f09b6c094014bc269b1197aaf2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035974, "uuid": "40daf13f-9989-4b3e-b3f1-46afe85bfc6c", "comment": "Malware payload", "value": "8dd2c87375b3161ac45a78a97ad6ca8d4edf3454028f9ef62656267ef14cfd93b7a99454c0173ea10186cd2d2e0e1d39", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035974, "uuid": "27d60acf-cc83-4b00-a8d6-cab13d38df2c", "value": "T1EA948585B7C2B88012875B76732FB1E6F52E4DEC7188084BE114FCA4F5B6A05EEE1935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035974, "uuid": "d954d7e2-1f4b-4466-8d3c-798ca28a8e45", "value": "6144:VeihdzCF5wwYCfRE9w6fu+UjweRRoORzwLGAF7lkPI+nhwK7:LdGX29ZUwSRLRcLG+uPLeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035974, "uuid": "1fc893b6-a508-4cc1-a77d-e4f10b6f56ee", "value": 409489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035974, "uuid": "09643e4a-b194-4b54-9dd5-1b6b93a21c10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035974, "uuid": "bd56fb5c-3833-44aa-98ce-1b226408ed9d", "value": "x.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff0dd3d-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775050599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050599, "uuid": "0c389c6c-4478-4086-b6a6-380372eaec2b", "comment": "Malware payload (ConnectWise)", "value": "b906ead19551a138ec5dd3d852296eaf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050599, "uuid": "5734662a-556e-4b76-9c9c-e9115c6da33f", "comment": "Malware payload (ConnectWise)", "value": "6cea11522affd8f1590c7735f7c2c89790871611e2feadb83d1219fd537b8fb9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050599, "uuid": "206a5100-7082-408d-9edf-d2bc07267ed9", "comment": "Malware payload (ConnectWise)", "value": "0ae014c0a47e3c81e3fe4a0db8fb42d5dc9729d9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050599, "uuid": "7bb0b39f-df60-44c5-bea9-371870659c25", "comment": "Malware payload (ConnectWise)", "value": "0c8750d4f4a96d660f21805f3924c685e1c27a569b8618e1a48de170902e48b282c5ef1bc09d910fb0522dafff8f39dc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050599, "uuid": "6660ba63-71a6-46fc-ac25-c66795c45c5f", "value": "T18CF633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050599, "uuid": "78f545cf-d10c-4ef6-947c-dd8814b59389", "value": "393216:GOvTi7hha62F3N11YOvTi7hha62rOvTi7hha62sOvTi7hha62:GOvjF371YOvjrOvjsOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050599, "uuid": "11d22e8b-897b-437a-ad02-808fd9e783c5", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050599, "uuid": "f3128f04-364f-4fa0-ab3c-bfdf11e8f733", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050599, "uuid": "c91f32d0-5044-420b-9a09-84c0774e862f", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f42854-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080808, "uuid": "f7c6ce40-412d-4fe7-aa96-9d4ad0290dc0", "comment": "Malware payload (Mirai)", "value": "ee17bab1ab48c118e7214ee6716be3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080808, "uuid": "cfae2872-09f0-4649-ac5f-5403d51daa04", "comment": "Malware payload (Mirai)", "value": "6d02e4b6622c6c5c40c7cf73ee74c69aa5642ba33908e016343f84530957ceac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080808, "uuid": "ba526384-e67e-4ccd-95c3-c2b92dcbcc11", "comment": "Malware payload (Mirai)", "value": "9309f46d1fbe59475acfa6c7d669d466970dcb1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080808, "uuid": "b2a4919c-583b-4530-8e3f-d6c5aea22aaa", "comment": "Malware payload (Mirai)", "value": "2e8c14ad87c8c4f705f75473d0a0264e1ea6fcdee852840b3b51d7bec00f0b336bc495e8a57e6fb52ef4c5ebde9e282b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080808, "uuid": "867c9cbe-15b9-4f8b-aa89-84a91fdddee6", "value": "T1EB93129A2B4B6D27F3BDDC72C2D5D6FF1905BC25A8081D6EB44FD0CD1E0A1E0EA50859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080808, "uuid": "1c7cdfd4-3170-4109-a310-196897970539", "value": "1536:EaCkN9HuEGezoSeY2yuy4LOhylwC7LWQjwLTC3JoGPaDpDCcpK+QeL3Y:EwNJujSr2ty2KvCvWQ0XC33gGcpK+QAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080808, "uuid": "f7d2c738-82e7-4953-98f6-236c2683bff3", "value": 94176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080808, "uuid": "2b5dc08d-3a19-44af-a3ec-2301befc081d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080808, "uuid": "490725a4-6552-44a0-a4c3-604b7ccb1409", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd340af-2d8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775022145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022145, "uuid": "7d2e3939-63ee-4e27-a5ad-a6985c5701e6", "comment": "Malware payload (Vidar)", "value": "03081a42b3e5a2f67c20f907cf08b63c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022145, "uuid": "f80b1f8d-b014-45c6-8188-66d2c5b7f4f6", "comment": "Malware payload (Vidar)", "value": "6d56f099ff02a11ccd233f8a9f5531d9a459fcbb2541551134fa9e435bfd177f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022145, "uuid": "c17f4d18-da12-40b2-92b6-d2f1c146b512", "comment": "Malware payload (Vidar)", "value": "4cc9e9ae7770aac08968adb0287665dfea308c66", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022145, "uuid": "4758cfd1-0bc4-478f-a841-68f5c8ac517b", "comment": "Malware payload (Vidar)", "value": "c9204fbadee2d9816bf8315e4d8e625da1d2e02511369a95a96aedf4d02126f600e18f3a10ea741699a2f92b108e0310", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022145, "uuid": "fcb3bf6c-680b-4669-a5c8-dac513aa0c8f", "value": "T1814165D4AFCC10C564AF811AC7E0F76922072AB695EE8A4C0EC67A925582ADCB195847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022145, "uuid": "381bf619-863e-4e09-a4e3-49943a976a81", "value": "48:mNuqUTa4aAyNqg1eLG7UuFW5K1PKI6GirLGirajdczR/eRM7:mNuqi9aX11eLG7Uz5wiXGyLGyayM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022145, "uuid": "959ec6dc-ebf9-4e50-8231-b526166f1ca8", "value": 2034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022145, "uuid": "c5719898-4357-4cbc-9e56-ac7fef9f4e56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022145, "uuid": "f06f7a7c-90c4-46d3-ba8c-64a1acf16162", "value": "cloudflare.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfecceb-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053626, "uuid": "1f14ba56-3ad8-4de0-b234-10f70ef80e09", "comment": "Malware payload (Mirai)", "value": "881f19e54a0d64c687c3b56ffdaffadf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053626, "uuid": "1b61837f-f93c-4f89-b048-4440064a93b5", "comment": "Malware payload (Mirai)", "value": "6dbffd29dc9d670bde2b4569985ec22380eed1bbd01654735d5af039cca8de36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053626, "uuid": "6586dd4a-6789-431d-9971-e716e97e771c", "comment": "Malware payload (Mirai)", "value": "9dd6dc698442024f5d48ac10d7dccc4aa11524fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053626, "uuid": "a3fe35aa-6e37-4438-a3ee-eca0df66f0f7", "comment": "Malware payload (Mirai)", "value": "4c102c923c060e8bf63dded1b0dca9800f0551ee6f4e121ec85ccd18be45bb0bd49d0b7a9091783844667cb6f7a1d401", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053626, "uuid": "f31e5890-cd16-429f-b434-3420cdabe4a3", "value": "T141146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053626, "uuid": "7d54abc1-0d0d-4b82-a93c-34a30b2af3df", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtq:BZAyFzQSdS7Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053626, "uuid": "4e940010-3610-4854-8c0f-c7a7b149cc4b", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053626, "uuid": "3aaa4912-bb4a-4bb6-aa5e-2bc7e3dcd2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053626, "uuid": "3e4aa9d2-be81-4bdd-b980-f6bd5a9d3fa8", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a948fa5-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775079984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079984, "uuid": "5501c7d9-dda1-4af9-baa4-ef7f5a09d821", "comment": "Malware payload (Mirai)", "value": "3f8978051adb3ec39a2e330001db8390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079984, "uuid": "251342a6-0e00-4314-8a18-55124d8e06c2", "comment": "Malware payload (Mirai)", "value": "6e84c611dda6f4a6da5e3b30ade19547524f83d41cd7541660b1b3a717ade3c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079984, "uuid": "c1dd5c9a-9895-4ff7-9c69-895b1f056851", "comment": "Malware payload (Mirai)", "value": "e65fe7908d6b2fbf7809449a82fb6be2fc99b953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079984, "uuid": "d73d6d2f-b649-4b81-9ed5-96fcb6a2fa64", "comment": "Malware payload (Mirai)", "value": "f4a7e0d64b7d02d2be0ff3585487325567a3433d07f44cc78b16f6d93534157d8ff01fedb17b90c9f56dfbf3c4d9a1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079984, "uuid": "5c78cdb2-5f0d-4375-aad5-9561bd5056e0", "value": "T12B333A13258085FCC40982B147BFA62BF562F4BE4234F58D6BE87E26FD5AD310A594C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079984, "uuid": "0fbcbff8-8eaf-4501-9afb-5a666b59e4fe", "value": "768:FnjJrbghrXpCJ9t3C0q0GNls1qt6No7MM7a0KGxDopKXobZ7/cKYeTBn:xdwG/t0XNlEq0C/7a0xxMd97cBeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079984, "uuid": "c754b06c-89b3-4cfc-8638-9743e860f5f9", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079984, "uuid": "19993251-5cf0-4a2a-b06d-4538acce42eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079984, "uuid": "98943f0c-17b5-4546-a5e5-908d9d11695a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e451350-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775063803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063803, "uuid": "26ff857e-5341-41e5-bc3c-1312a977559f", "comment": "Malware payload (Mirai)", "value": "69756046f66ed02754a1a530e76d6702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063803, "uuid": "5d84031c-054e-42ef-b67c-a3f0e27adade", "comment": "Malware payload (Mirai)", "value": "6ef5fe2086a7356d6a72fd309443ec71b3101938bfb6c4574160149451718f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063803, "uuid": "e4e25f08-d23b-4d85-bd7b-31f9d8abcdc6", "comment": "Malware payload (Mirai)", "value": "5dec1d9dc81d8c9e5dbbb227935b78cd770cdc7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063803, "uuid": "20aa09a3-7bbc-4f2e-81f0-3a5b27113245", "comment": "Malware payload (Mirai)", "value": "38a2b67b87c9ba23c1a8ea92c9be7925751ac445198b3e7f60431d7d93315f68b1d9db5fa5ce675f5cfa08c5c3bfb141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063803, "uuid": "e0a6f0b8-c8b5-4233-9a65-bf9046d7eb9d", "value": "T1E5E3C71A9F950EFBDC6FDD3302A9060235CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063803, "uuid": "1f229432-e675-41dc-82fe-c00b16af530c", "value": "3072:i9TmusSMxQw5Zaws4/3UrVDBDPhHqBpw:i9yusZaw/8x1Puw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063803, "uuid": "b35fe5c9-50f4-405c-9a96-762066b5a2e8", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063803, "uuid": "b4e7f37b-a4cc-439c-9b43-7af69a2aa664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063803, "uuid": "270f8394-176e-4f94-a7f7-751d8567c0f1", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73198ff-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057537, "uuid": "dbd84d1b-8687-4463-96bf-484762c75e7a", "comment": "Malware payload", "value": "e39a8e1575c19298765bcd32bbbb98c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057537, "uuid": "6881f311-40e8-44d6-a715-99d949dbc5f8", "comment": "Malware payload", "value": "6f64605014974a7d8d87a8233941582ff4ba9bed6ef60f1e2220a8f868f668b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057537, "uuid": "fb81663c-e32c-48df-a94e-44560f7ed2c3", "comment": "Malware payload", "value": "25af0517283821f84bb6a423fe1a4382eaf4800e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057537, "uuid": "1bc2f776-d0e7-4f87-ac17-38a027e4a8a3", "comment": "Malware payload", "value": "3e82669afc020ec45038b373e5a066fe7338a04e9bc706efe2f9a59aaa9644d1f1123e0fa64c9921f36ae07978ffddfc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057537, "uuid": "9d0f4c8a-23bf-4fe5-b751-7e1ec8d27f2e", "value": "T1B2D22AEE8903B9F60B163A0F58CA5171DFBD6A516426C021B0AF9B1D27009DCD6747FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057537, "uuid": "1281bfef-752c-4e8b-b73c-87b92a1749ae", "value": "768:ixQ90b4nJNghFR2UmplENBPaQk+P+tJs2qq1DbU:ixD2llgBPaJ+KJmq1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057537, "uuid": "9eb6202b-2e97-4cfc-81d8-4284b11ebc7a", "value": 28752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057537, "uuid": "b01b90d9-f180-42e1-9146-745bee005ade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057537, "uuid": "dda65992-2db8-49b2-9c1d-7c1b93aea38c", "value": "11503-\u96fb\u4fe1\u8cbb\u96fb\u5b50\u901a\u77e5\u55ae\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d50eb5d-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046568, "uuid": "119f9417-a7ce-4618-88ea-944db997a8ed", "comment": "Malware payload", "value": "b9ccf8489acc7b26b93f1481af54c872", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046568, "uuid": "38634102-5443-4a08-9f28-85812cc285d3", "comment": "Malware payload", "value": "6f76ee849452d620288c6f7f4619b81b3c706177313fecbea706aa05ac4ab1e3", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046568, "uuid": "90e5997b-dcbd-4440-b5c6-5774317c1dac", "comment": "Malware payload", "value": "6bb01eaeea768c22d2479c9a635c38ba927d81c8", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046568, "uuid": "2cd511c1-da75-4630-9631-c0a9f2b10f4a", "comment": "Malware payload", "value": "4b2f386ccac222adf371c1a053faf05bb1eac5a2eae76a565cb50848979adf4fc212c5954eb7beac95409f7fe008f3e2", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046568, "uuid": "b70cbf85-6e40-42cd-ba12-bf009a72c816", "value": "T16733C6FF08FAEA2448161C4775D63E73209CDEECA18D07CC9B4F0A48556886F2F646DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046568, "uuid": "5b90db17-d501-4bb0-9aee-04775b1ec7f1", "value": "768:Th6+NV7UZ2Byan9GnhbH421J+ntiL0VOmTuj6Mol+3O1EHeO+:TZLyan9Gn7r+AyXegAHeO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046568, "uuid": "9ce68136-b1a0-4e71-8aa8-6ac470b74565", "value": 53668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046568, "uuid": "875b53df-0ec7-4e63-ab0f-cc61dcd78912", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046568, "uuid": "ada07405-27b3-444f-acc9-2cef1c93a52c", "value": "6f76ee849452d620288c6f7f4619b81b3c706177313fecbea706aa05ac4ab1e3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ee4745-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "3d576bfd-cd5c-4cc3-a9fa-fc02eea7c370", "comment": "Malware payload (Mirai)", "value": "60c434c7a37ab76275741cd87657c678", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "f2e3929c-75cc-4bb3-97db-0075c070b17f", "comment": "Malware payload (Mirai)", "value": "6fe4a53323e0dcaed0c57799048ec76236b93de15b9d0266ad1b678cbfb5aec2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "77163a1d-35c5-44cf-9ba6-d864f56914ce", "comment": "Malware payload (Mirai)", "value": "0a3606fda9190f2b7bafcc3933d078e588e734a3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "ce493e2d-b380-4104-be78-3f82d642718d", "comment": "Malware payload (Mirai)", "value": "56e5e755bf1ae1dc629c76369184f74155c337edc1dda1e8c6e1c5d2b593c9401127b46978de73bc74ba9b87c7bc2246", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "1d75c71f-fdb2-46f7-a1cf-8f7655f03d82", "value": "T1EED3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "621c04ef-c6ca-474b-b208-2b419059c5a0", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zd6:xOFgpOEoVv3MXL5NhGOd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053594, "uuid": "97ee9387-e2b8-4c78-8125-888905b1e24c", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053594, "uuid": "a7505433-94b4-49b5-af06-415d17ffa647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "6e6a393e-91f6-488a-9a21-e773196d7aa2", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5817c5de-2dbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775042238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042238, "uuid": "14239fcc-78a6-43b5-971e-9ed8e6919631", "comment": "Malware payload (Vidar)", "value": "1dbeaa0d52b10cd4a92716f94545f924", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042238, "uuid": "e0832db1-2999-40dd-bd05-0275852a771c", "comment": "Malware payload (Vidar)", "value": "7045d1817de813c33b9765ed6ed894fcba75a23323887e5e1bce6883cd9e7da7", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042238, "uuid": "31554e5a-29f6-4e7b-a008-85daefd6848b", "comment": "Malware payload (Vidar)", "value": "887f36355e6df70c8a349af949dcc24a92b653ee", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775042238, "uuid": "837e2424-3b2d-4354-a7ac-081a2a11043d", "comment": "Malware payload (Vidar)", "value": "3bbf3b50e157277f63f8391f1d51795afcd5ff990c20c7cbd629b468b6057f7961cd774650874c34043021a94d5a217f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042238, "uuid": "85c3691d-3b68-4cfc-93d7-225c97d0b65b", "value": "T10B958D4B7CE008BAD07A933288B662D2BB76F8590B3233D72E50A6783F767D15935750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042238, "uuid": "ab7ffb46-cee9-41a0-86a7-b0a981fd03c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042238, "uuid": "89a43453-4759-49a8-8a9a-836488afdd52", "value": "24576:BOkwVy1mZp0VYLo2pghENQHXO2XdWT4CS2JNBzES6ggp+KCGiWDt/fec:BQTZp0VYZghUQHXOTSKz3r2+KpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775042238, "uuid": "ddc6324e-527c-4d53-8743-71ed3daaa0cb", "value": 1910432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775042238, "uuid": "981cb08d-b834-4074-8265-b28e393c27f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775042238, "uuid": "6dd5e60a-3559-4d5f-b88e-ef9a6cb4ffb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a546bb8-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080789, "uuid": "da99c923-5020-4e4e-92b2-46483aca60dc", "comment": "Malware payload (Mirai)", "value": "a35a50bab6a6c8c4f16ab689d68bbda3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080789, "uuid": "6bf9d7c7-4e02-4a0a-8b31-93a150406540", "comment": "Malware payload (Mirai)", "value": "72bdd82afd5b633567f7f3af14631740d96bf3ad280aed2ad1dcdf70029b9cdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080789, "uuid": "83dc36d6-d080-47a8-853d-44f040a6c7a1", "comment": "Malware payload (Mirai)", "value": "a732a14aa7008e2fde9ed98de7a4d67a1c97fc37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080789, "uuid": "10b9b9c0-6dbb-4589-81fb-65a7ebc33c42", "comment": "Malware payload (Mirai)", "value": "293ee45b29e07a29c988a3fd61225e384ebc45c44d8827cb13e3083acfff76ecf007b350c4cac564213f30699733e170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080789, "uuid": "05d1214e-51d4-43ec-bb60-918185cfd411", "value": "T16C345B03FB92C6F2E19301726086C7665770C9325216CC0BF7859A79BC3B609966B7BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080789, "uuid": "93ee58d1-553d-4065-826e-1ab13a414be0", "value": "6144:hLz8h8eS1ayNXKv21ckZuZBsyTGxiVSP8:h0h8hayNXKvErZuZTqx4SP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080789, "uuid": "be8511cb-fe54-4ae3-9128-5404ac0ff54f", "value": 244364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080789, "uuid": "49027205-a5c7-4683-ae1e-68ea600ae8a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080789, "uuid": "aa81a5e5-3b82-41c7-b13b-cb9c98fb0c27", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611bf183-2dc3-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkWatchman)", "timestamp": 1775045259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045259, "uuid": "2a54cdef-3f46-4a51-a9c7-ad47f78a7e34", "comment": "Malware payload (DarkWatchman)", "value": "61b417786b39f3a49b398fbf5a214480", "object_relation": "md5", "Tag": [ { "name": "4ad74aab-cfd", "colour": "#EF2EFF", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045259, "uuid": "3a57c6bd-e2ab-4ba5-a790-57b7cf8a96f6", "comment": "Malware payload (DarkWatchman)", "value": "72c35c67d1d70b9c504b62f4fcd18698f9a3d1e75e3ecaf9768a773c855aea77", "object_relation": "sha256", "Tag": [ { "name": "4ad74aab-cfd", "colour": "#EF2EFF", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045259, "uuid": "3c96e931-bdd9-41ea-a970-42f754299498", "comment": "Malware payload (DarkWatchman)", "value": "eab20d196e88912e2e1f6019136b6ca99907c567", "object_relation": "sha1", "Tag": [ { "name": "4ad74aab-cfd", "colour": "#EF2EFF", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045259, "uuid": "acedcf4b-2c55-4571-aafa-e4485fdc7ae2", "comment": "Malware payload (DarkWatchman)", "value": "42554457944f6a89b13900fc8db85c604093d30655997d602743b64aaafcbc58aad77286fe7eb27f33cf812107e0a5b2", "object_relation": "sha3-384", "Tag": [ { "name": "4ad74aab-cfd", "colour": "#EF2EFF", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045259, "uuid": "7b557717-518d-4dcb-b404-b2e4f0177344", "value": "T1AC84C002F7C18872D57319315939A7266D3D7E201F28DA1FA3E46C6EEE312C16625FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045259, "uuid": "0492639c-9ba8-4709-8eb1-5baccefa7ed8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045259, "uuid": "b7b8b1b8-b1d6-4d79-9017-128bf3320a73", "value": "6144:1OYGXaPNxdgSdcq2pVZPOJHAbK/Y1QCPqwdLeKrUkGjzYg:xGqN/XdctpVtkPY+bwdyRkGgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045259, "uuid": "aaa716e8-d697-4013-b369-b82084bd5fc7", "value": 405528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045259, "uuid": "1284fa2a-aa40-46dd-b76d-8ae39aa787a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045259, "uuid": "cf7b6975-d18a-4e0c-a5a6-148b47d9ea94", "value": "\u00f0\u00f6\u00f0\u00a5\u00f0\u00a6-\u00d0\u00e9\u00d0\u00ef \u00f0\u00a5\u00d0\u00e9 03.12.2025.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfc47ab-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053304, "uuid": "43df77f2-67fc-478c-9dc9-153da6eabecc", "comment": "Malware payload (Mirai)", "value": "3a74716229e8e229bc5047f2bfe94ff9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053304, "uuid": "a5cbde4f-3b65-4389-a225-f92d596f10e9", "comment": "Malware payload (Mirai)", "value": "72cc7f6a36482e2e5dd0e2d63aaec1878cfe09991c088d31575ce5667ddbd844", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053304, "uuid": "5f481ea4-7838-4087-bf50-562b33459df5", "comment": "Malware payload (Mirai)", "value": "ee006ecb52f864dabf1b289d0345d778eeb0cef7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053304, "uuid": "403795ef-26ed-41ab-b9d8-39bb00ad22d4", "comment": "Malware payload (Mirai)", "value": "a2bc6f46a035aa2758eecf7172a721b0a448803808b4bc85bddee7d180c77ffbead48f8c41709fc16c9693c9c9ca37b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053304, "uuid": "387d712c-e36f-47d2-a989-37f0d30bfbbf", "value": "T109133A92B400AD7DF85EE73EC093090AF131A79551821A3763A3FD776C322A85D76E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053304, "uuid": "c5cc78b4-d6a2-4412-a0a8-1128bf29809a", "value": "768:0xqFTD4t0MoBjFNWEw0Cmk+3oh6WluD811JtTRHGtHwl5bsW71:COaWVLWLHVv6WkD811bRHGtwlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053304, "uuid": "96e55fd0-32da-4043-8bd8-e482bff51e35", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053304, "uuid": "d02418a5-cd63-43cc-b530-33afcfa7cd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053304, "uuid": "a1f614a5-4ce7-4c78-b89d-c4bb55549e35", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2039e6b-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022685, "uuid": "5d9a02b5-ba87-4b2d-984d-95ecbc853068", "comment": "Malware payload (Mirai)", "value": "cc7308b94ff5548915c83cbc29b5200a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022685, "uuid": "165f1c53-4597-4bb6-be1b-a0e616b57e71", "comment": "Malware payload (Mirai)", "value": "72e34026135410e3c8a717bb3cb16fe624b7259d88fbdfb1bb20dcadaf3aa386", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022685, "uuid": "ba2c9783-cc69-4568-8aaa-3dddb7f3b789", "comment": "Malware payload (Mirai)", "value": "f648af5cad7f4eced4b30b63064e3db350eedd0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022685, "uuid": "f68a6cfe-ed22-4c1e-880a-63e4f9333cfd", "comment": "Malware payload (Mirai)", "value": "573e21ace4ad9d9149ecfef636cdb9dd55b8049ea088e2787ba6a37dedf77c75451938d4e8aab618b8731f96c18004c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022685, "uuid": "3a54638f-9dc7-44fe-91df-616585a4dc47", "value": "T11482D131A48516BAC3704039E92A4282D366DAFDF3EE72BB302C1750F7A581916FD297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022685, "uuid": "1e928214-4c32-4b5f-b9b4-9833fb97f00e", "value": "384:Ht3POP0KmCfJ0gNPjsTLM1jnaGfxcHxS2tSsTwF4hymdGUop5hLE2:HtfOMKmCfJ0ghy2aGpN2hEus3Uoze2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022685, "uuid": "088d5e58-53b2-4487-8e44-c3c134bb7954", "value": 18564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022685, "uuid": "27c457a9-08d5-4eb8-b8d8-4528e35c9b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022685, "uuid": "16dafe13-cc7e-4ece-89c6-31e08c3207d8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04cb695-2d74-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775011542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011542, "uuid": "359f7e6a-f37e-4a86-b8fc-db0aacaad32e", "comment": "Malware payload (RustyStealer)", "value": "930f2758f2f76e7ca0a6ccd80638e282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011542, "uuid": "846efbaf-284d-4a08-8a31-2ed074d2882d", "comment": "Malware payload (RustyStealer)", "value": "74edf6950c62bc4cfbaeb1a101316f231ca010cc9777d2e42d46a174cbdac598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011542, "uuid": "03a48b02-d284-4cd6-9ea9-fa36b925db09", "comment": "Malware payload (RustyStealer)", "value": "e2e2e438091cefbbbcdd6152570b59ef77e74e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011542, "uuid": "9709c448-fdd3-445f-b8eb-7837e5075576", "comment": "Malware payload (RustyStealer)", "value": "1ba4592a4681e8ac4f76a68e8b0465eb2fc724de5651882d3a5dc36f0bf91085d3381cc426b7a2cc1d353063a7e0951c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011542, "uuid": "3920b440-67b6-42c7-8ed7-f6368326740e", "value": "T1CEC6AFB8B6047DD6E67F467BC996ACD803762E229A87A4CE40647FC315B3375EF02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011542, "uuid": "8d27c8fa-e85b-43b2-b1b8-243ac24dd01f", "value": "60c512b6ba9defda3d35824d56a5ffa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011542, "uuid": "63b5c444-21fe-4510-9b79-a0f0307bf856", "value": "24576:BvYVYuM5K9fvTneNulF9kz/a5cuSC8aFUj17AZkwEmpFnYZN75E1y29HEIP5VZDa:W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775011542, "uuid": "3bae0dfc-2810-43c7-9ca8-97b2b3edfb94", "value": 11761664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775011542, "uuid": "106cc77b-e333-4906-886c-e003d2fc4fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011542, "uuid": "e7153de9-c8d1-4dc6-99b1-188b8a8ad6bf", "value": "\u4e09\u4f5b\u5854\u9ed1\u56ed\u533a\u5185\u4e00\u540d\u4e2d\u56fd\u7537\u5b50\u672a\u8fbe\u6210\u4e1a\u7ee9\u53cc\u624b\u88ab\u6346\u6bb4\u6253\u793a\u4f17\uff01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ad2567-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064346, "uuid": "da29e4e7-af2b-473f-8085-350246c1cdeb", "comment": "Malware payload", "value": "bdbcdb26e1ff3e912054f7e3d5d0f893", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064346, "uuid": "e7e767a8-11eb-4e3d-aa9a-0fda91667915", "comment": "Malware payload", "value": "75a2a8f7c36f28b3ccd0eb44837a0bdf60c375acc87841891ff8de49f3f958a6", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064346, "uuid": "6869bb4f-bba6-40f5-9ff4-6e656fe97010", "comment": "Malware payload", "value": "e138307d13d0ac5f6bc88006ce5c2fe76ae884e9", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064346, "uuid": "fe4a1403-42ed-4271-ab15-238ee1046af7", "comment": "Malware payload", "value": "1589ac4cf577330cea121b017279cd60bb85a2aeccb30abca97eca91fbd831250744ff0648c8090c4bf9f52ac23b771f", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064346, "uuid": "0c260bce-63fb-4adb-8c99-c24874f8e028", "value": "T110E63322832AE455ED773B7938AEC30AD53EC6D83B06B5CE2DB60A9D6C855D0434B70D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064346, "uuid": "54a1175c-84a8-4145-8913-f3e7abe8c702", "value": "196608:tSNI3rg2DDB28b2cUk2tf6/o0fmLrOLFjQR6Hs5JqNx3Q8SDUBdDOGAXUR4JhmsF:rbDVHb2crwiXmL0tEHUx3Q8SDU34E8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064346, "uuid": "237ab7ea-420b-4fb3-862b-ca5db193266c", "value": 14578513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064346, "uuid": "aebff4e2-2525-42a2-9843-0b9689bcdd28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064346, "uuid": "3e215e3e-1d64-4271-b9aa-eb7fcea98daf", "value": "545153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f65e8d4-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053309, "uuid": "59709f22-672e-47e1-96a5-37ebb67bf04e", "comment": "Malware payload (Mirai)", "value": "387815367399df6e44afc22276b397df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053309, "uuid": "b27196c0-ef87-4219-baf2-eb2286346908", "comment": "Malware payload (Mirai)", "value": "76757ba65d7eff5bbbf6b3b0717fff216b583b3116e33320af600d3bbd618bb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053309, "uuid": "619b00fa-0477-4d8f-aac9-1ef2ded34f64", "comment": "Malware payload (Mirai)", "value": "e9f43e42f193356b17dfa888eaaeb2f671e8fe10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053309, "uuid": "e45c70fe-6d75-475d-bcc6-781c14a04fda", "comment": "Malware payload (Mirai)", "value": "d6d3cc60329a0c93cf1ed922bffcfa16285817d21efa51d779b00a9b6fc04f1375a539431aff4894e23b7bd8cdb01da2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053309, "uuid": "fe74f6af-637a-4b8d-bc4f-55c86e0fa808", "value": "T15D233A49C703C1F0D8861570507BAB7AAE7AAC325570ED5BEB983A26BC32B11950B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053309, "uuid": "b5eaac4d-bcc8-4520-af9a-45b7e775e733", "value": "768:sXK15wniDa6PO5+m0h5phjSrJzm3W/NqNG1UJwlAscucuN7iKlkH1GsPK9K:sXK1KIfPk+m0rSom/D9cu5CGsiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053309, "uuid": "782bf3c5-ff7c-4105-96fb-4c0725528398", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053309, "uuid": "05ee5f71-f778-4028-9a8b-8ba54cd49a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053309, "uuid": "6bae2c7d-83b4-4a33-8d03-3da8005cb8b7", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e809b8-2ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775056137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056137, "uuid": "f4467912-53ac-4d69-beb0-009e7b446ee1", "comment": "Malware payload (Arsink)", "value": "bc46827325acd994aec253486292c4f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056137, "uuid": "94674117-f6df-4550-848b-8f259030b834", "comment": "Malware payload (Arsink)", "value": "76b8569eff05ce94ba580e10fb1161af6537d931f8c9d07edba20e93a4a34bb6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056137, "uuid": "87a4eb4d-f18f-45a7-8f4e-b4b243026373", "comment": "Malware payload (Arsink)", "value": "a5866127a3475c73eac4c600cf79754c2c148af9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056137, "uuid": "1325d5c3-f245-4bcd-ac4a-2ce6855b55cb", "comment": "Malware payload (Arsink)", "value": "af3a0b6c0d486c7dc1c6827d97475e8cc50b1ae65682c6cc50ee787eaa1b3d68729af07c07856659dc2e57b5fde628a4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056137, "uuid": "40b9285c-550f-4328-ab06-b59ba8635f10", "value": "T1E8E523838129C387F66A7E341F17FAE196939D312628EF86F4D357C0D6F790A86D2211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056137, "uuid": "327bb295-a8f2-42b8-ad7d-1ffc3f573e39", "value": "98304:RDAQ1fgrn/aRr8mu3q4QP3Rnvlvyo6tbHjU:RDv8/EJu3aJn9vvibHjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056137, "uuid": "5b2cd4b6-6ee6-4659-be21-17f8f47c4ab8", "value": 3294081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056137, "uuid": "ca553b65-4856-4e06-98ca-700caccabc5b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056137, "uuid": "1b497d0e-0dab-4bf7-97c9-308e4ff93cdd", "value": "\u0428\u043b\u0435\u043f\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5fe911-2df2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775065651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065651, "uuid": "dc16e28c-cd7f-41d1-a6a4-8181b9d6e56d", "comment": "Malware payload (Formbook)", "value": "a4dfe0af090b36e42f8c750d638c6bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065651, "uuid": "4381cb5f-b5fd-4b6b-b954-9016b36c6967", "comment": "Malware payload (Formbook)", "value": "76cc2e6844b7360c632e50db7aac40e3cd001a496ee045ef01e4ad56c069c011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065651, "uuid": "1eea4727-5769-4eec-bf50-499e88f7fee0", "comment": "Malware payload (Formbook)", "value": "0c72ae19b4ff26ed3ae83b6003c15829f5bff460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065651, "uuid": "56eb76d5-3bf6-4f9d-9153-0e9a91f13869", "comment": "Malware payload (Formbook)", "value": "126339e7b70c0c61b4025fdfe0a4653be4b60142346c2b793fd6108b2ad46abe02dd0b611a33d3632e893a4670306aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065651, "uuid": "2ab0b161-8625-47d9-a364-3930110117b4", "value": "T1A145F1592369EE02D4B75BF40970D3344BF5AC99A422E30B9EE57DEFBA397012904393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065651, "uuid": "de51e7a4-2370-4d4d-a686-a3369916dd33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065651, "uuid": "0f7eaf8d-e4b1-4131-90b0-082aa6dd719b", "value": "24576:1xNxODfWvluHQPzJoOw/sJ7elfJUARz/VslpZwcSJJSHw:1Px4cluwPdonAeBJUARz/VsGcqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775065651, "uuid": "c0088d95-6945-4936-afcd-a72739f0f41e", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775065651, "uuid": "401bce35-8097-4a9c-af8c-e4df654d4f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065651, "uuid": "9e5094dc-1f11-4974-8043-ee0df6262027", "value": "Purchase Order-PO56677-RVS.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd202c-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028582, "uuid": "d3cea9a4-1173-4f6e-bcad-2e60836abbde", "comment": "Malware payload", "value": "addc4985887b80b58ff3113c062b1fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028582, "uuid": "26d44a1c-4853-40d1-9be4-eff7b6aad511", "comment": "Malware payload", "value": "76fdc0fc53758a6e00019df7c9d034de03fc6a22252ba2ed94cb9758de851041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028582, "uuid": "ffc04f95-34aa-4031-b333-70d7afca9616", "comment": "Malware payload", "value": "d09928473eb539f687e0f2d71d29303b64f9f9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028582, "uuid": "39935b6f-47b4-4e44-8261-be71e43baf2b", "comment": "Malware payload", "value": "19896598526b2a80560731cf37bde81e0df1eddce414ea753133fbd9cf923a5f645f21c4ba634551f5128aff73ff3f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028582, "uuid": "40232a7a-1b68-4aa0-966b-6d93e7a2cdb0", "value": "T1DA773B83F8E21EE4D4EAC571D129815BF6723C291B3823DB16A0F7241F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028582, "uuid": "e8cb2fd4-87d9-4e5c-805a-a326183e1c5a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028582, "uuid": "80864c4b-0510-4585-94a4-d9fa9c2d22cf", "value": "393216:rADmkaROFhihSDPBzaMuKaGpsWKctOCrn24Lux2JtEfmNSxXwY22oXvmIrbtCoXf:rAqkawFYhSDAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028582, "uuid": "5e0fd0e8-90a4-4920-955e-d93dfae2a95f", "value": 34931200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028582, "uuid": "84b07a51-3dc9-4f90-8ad3-ca617d7b1b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028582, "uuid": "b0409f38-a5c7-40bb-aaf6-f75d60aff5ee", "value": "addc4985887b80b58ff3113c062b1fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb10bdcc-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775080280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080280, "uuid": "c688ba8f-cf63-4eca-80ba-8f4ef845ec09", "comment": "Malware payload (SyncroRMM)", "value": "d771fb0a8244d48bc238e96681fd224b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080280, "uuid": "42adac72-2b91-4059-9f31-c979ddc8ed28", "comment": "Malware payload (SyncroRMM)", "value": "778e957d75bc317eda0c29175cba9ddb644a6e33ce80acabead572d1ccde8a9c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080280, "uuid": "477d6e37-9f5a-4205-b363-21541f8bdd87", "comment": "Malware payload (SyncroRMM)", "value": "b7a67558c5d3633bbdb586a3a7bfc52a09f0359a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080280, "uuid": "490dde69-3b92-401a-9d13-e0e07a548669", "comment": "Malware payload (SyncroRMM)", "value": "1f19388d3002267950f3131881b45a530772b3eac4d04fff4d1122c33e399320472ff81bf6c1da17ec9eda84e05a1dc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080280, "uuid": "97dc7332-edd7-430c-b417-d990cf21949d", "value": "T1EF461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080280, "uuid": "e9b8e1e4-e19b-4489-b48b-bfb01b7e4439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080280, "uuid": "17cd9b5c-ba5b-409b-8baf-0b51fbe737c6", "value": "98304:Uh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Uh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080280, "uuid": "eaa70365-e289-442b-8e8d-590d8f0d9166", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080280, "uuid": "03272b3a-97c7-4bc5-a921-c61a5bbbb101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080280, "uuid": "f1347dfb-a0ee-4ed6-b0c0-f14ef12bc2c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba1aa3e-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046565, "uuid": "bb11e79b-1755-475b-9371-15113d998b21", "comment": "Malware payload", "value": "bd380d631731783026292f5473173fa9", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046565, "uuid": "1a512823-769f-4cf2-97fb-f99962372cbe", "comment": "Malware payload", "value": "784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046565, "uuid": "b8ff4801-eb67-4224-87ee-d5a813ee35fc", "comment": "Malware payload", "value": "8ca23b787bb6a72db15a01c5c8c72756906192ce", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046565, "uuid": "40b81108-35ea-4933-8fdc-5704dad5a6b7", "comment": "Malware payload", "value": "6706bfb57d0c2aeb8af2e99e89381468bf3bd5b354add1aebfc0e0c8349fbf970cac0f9dfb266f77511c6c86c6c93a01", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046565, "uuid": "30cf3486-c3d0-4eb8-a8cf-49953e2e028a", "value": "T14933C8E16A122938C68BFFC0541DB30ECE26F33CF42F4965265211A8D59577CEE69CA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046565, "uuid": "1c931151-a3b0-47ee-8ecf-a2c217723d0a", "value": "768:EvtZ6BmoBWaet+ZGa/jyiRGcWL3lbR+eLLiNzgAxh73jCGuZBCosY3cBqeK4Ge:oyBWa84Lyisp+eyNZTuZxB3cB/K4Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046565, "uuid": "8518e706-106a-44d0-9465-9051b9e6f00e", "value": 53322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046565, "uuid": "afa6f083-3d7c-42d3-b762-60880f745876", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046565, "uuid": "1881f957-94ec-42e8-9a2a-ee10e09fc42f", "value": "784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ebfac8-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057530, "uuid": "93ed3840-0621-4380-9c70-29e75db18d20", "comment": "Malware payload", "value": "4a11fcc2113425c053f8cae82bc5f8c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057530, "uuid": "697f6674-2c90-491e-86f2-b06b4eccedad", "comment": "Malware payload", "value": "78d46a8d00fa4b30f2982b0996625ad0593bc1490a66c589ff2ebf6b39bb0180", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057530, "uuid": "68c9bc4f-6fba-403a-8b3a-b8cafa985d83", "comment": "Malware payload", "value": "4b85976bb568dfce03b13c69b0c18299a300e888", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057530, "uuid": "7d7276d5-552a-47d2-b00f-e6c8b4be1306", "comment": "Malware payload", "value": "5dee582e75a2ff94ca2b128df46196c96c8e71a1494f59eb9dfd2355cf4245fca8da1d7e8a75308594c522292e66e29a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057530, "uuid": "83903590-e047-4f57-ac71-768bf20220a1", "value": "T11C746A0357FA8649F5F74F99AA7A10A14A77BE6A1C79C42C119D240E0AF3E04C8B57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057530, "uuid": "d9959378-1cc5-46eb-b692-284cc399baa1", "value": "6144:nci6RnbT0MCKL5h6zODbDtfp0v6GjHs3bIJXUkfjgHIT3nqM/HF+rL0/Gi:nci6ZsKL5ozgP5ivlsLqUkfUoT6+Ac/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057530, "uuid": "fdc00be3-a48b-4191-ab4e-c37d9e8fe32f", "value": 341974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057530, "uuid": "10f182f2-7722-46c1-846f-6682f5b9fce6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057530, "uuid": "8e235fb4-6974-4fa4-82e4-b3c3c648a916", "value": "PO#73926890 Wolter Asia Export.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcc3e66-2db4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775039002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039002, "uuid": "f5f5e47b-2742-44f7-b0a1-ef4eeafdd998", "comment": "Malware payload (Mirai)", "value": "c58b5aa8abf7ae0fc6ec73efd3ad700f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039002, "uuid": "27dd3fd5-af43-4a01-957b-da867a22e753", "comment": "Malware payload (Mirai)", "value": "793ed95eb6ef4d880d85e5aaf46a415949a1894a1f1022aa11e9d8923e8b1b84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039002, "uuid": "f236f6a0-17a1-4968-a7a2-369bcdb6be14", "comment": "Malware payload (Mirai)", "value": "b76a784a82d9ac85966e4b00cb16f51c6e22232a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039002, "uuid": "f55cba65-dcf1-4853-b1c9-07b5b204dc4d", "comment": "Malware payload (Mirai)", "value": "a68b2556c4f0463a8e7e6c8d6c9a0dc89c0787929f3cc267599fe947481bc23a3ef9c8c1655eb136d9ccaa3562c40d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039002, "uuid": "7ff22208-c761-4fb9-81ff-3d89d0a6a692", "value": "T1C863029BB01FDD71D8421D713AE2D148F350E64F9AA61B294D051A7C8EBAF32142DBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039002, "uuid": "3538cdb2-16a5-4494-ad87-c320576e91a2", "value": "1536:fSA9ENb1r8Vr6oU19i0lzM339BtKfdYMWzT0nmMCS5mpxTVI:fSAUb1OQ19i0lz439BgdY10mMohI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039002, "uuid": "08990015-deb0-4d95-b9a5-5987806d5517", "value": 70748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039002, "uuid": "7fa3195f-eef9-4589-9a48-ddb0161f06dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039002, "uuid": "1e311e89-6576-4729-ab59-89e36c710d24", "value": "kurayami.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc94aa26-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1775028716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028716, "uuid": "bc2085f0-567d-45d8-8fec-23d9635a8d56", "comment": "Malware payload (DonutLoader)", "value": "7de220d7296166fbb91e889fbfe0737b", "object_relation": "md5", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028716, "uuid": "9100f063-d031-4f1c-b91e-44f72bb912d1", "comment": "Malware payload (DonutLoader)", "value": "79906bf915f0223acf95bbf4cca86df0dcf9f128663ad34ed0bda82e5f40d42e", "object_relation": "sha256", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028716, "uuid": "694fc62d-ed49-4964-8d24-e86426406f0b", "comment": "Malware payload (DonutLoader)", "value": "619d7e703f2178cf1794dac78c1da8aa3b1353cb", "object_relation": "sha1", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028716, "uuid": "c71a5e52-9b40-471d-9bdf-afe263a6dc7a", "comment": "Malware payload (DonutLoader)", "value": "7d8d919099a38eca777c1ed52e4a59c6d829f2ba76c14522a5cedec71e264457b060934623ad34bf009b3dbf435f5a71", "object_relation": "sha3-384", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028716, "uuid": "19d77d3d-82ce-4439-a348-b564cad117fa", "value": "T1D546336476AD2E38D59A963E0A0F3F22F60126FC9721E03C17469E0B5237F7543B9729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028716, "uuid": "c330194a-2791-49cd-9f01-f7b87bb4bdb0", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028716, "uuid": "41b3dd01-97d8-431e-8439-1e763999f4d1", "value": "98304:mgH6BUkSSUfixd2jVZp9541rE8/XcpnC7TmyXeb+2kAK+rAp80pS:mgaBUkS7fE2jV55yrBOC7TRfAFo8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028716, "uuid": "2b1f9051-04e9-418c-a9d6-be148d6a0aa3", "value": 5563904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028716, "uuid": "df006d3a-7153-44d4-a5fe-5762bfe1d16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028716, "uuid": "6e5a7d2f-5063-4fc5-a638-61c608daf925", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3fabe5-2e1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775083748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083748, "uuid": "f4faadc6-5b24-4ca5-8778-dd55235cf5f7", "comment": "Malware payload (Mirai)", "value": "d8058368392690e3c7cec607eaaedebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083748, "uuid": "b1ab955a-63c1-4fd2-b0a6-a0e92e0a2780", "comment": "Malware payload (Mirai)", "value": "7a1136c218ddf262cb29c1bffb4b7dcbd39c2c9f435bd42287d4c3ad3f2db7d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083748, "uuid": "3169846a-ce21-4ac5-b288-206b1d5cf756", "comment": "Malware payload (Mirai)", "value": "b49768f13a5d2a957b64a14291784f91093aafd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083748, "uuid": "f17036be-eb24-4b33-ad58-3097dfa13a4f", "comment": "Malware payload (Mirai)", "value": "139e90b1efd66438419743780bf7ae9e4d62b2ad412a5d5445bf707588ab229c574f0d1a126e6387001b6298b0ade451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083748, "uuid": "44547698-981f-4dab-a1b2-ecf5bc2ea20f", "value": "T1EA13F954BAC1462BC5D52278A2AF5BED3720A3D5E2CBB303D5245FA47E8264F0E13F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083748, "uuid": "c9f3bfd4-c11d-47fb-abd6-3526cbe65d70", "value": "768:ki+yEyHiG8mwTeb0pcLFSxshZ+DqdI2yty4obQw7BTEsHPeV2:kZycPVTeacLxZuII2ytQ7BT5HPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083748, "uuid": "0b9779e0-77bd-4bd8-9f5c-a65eed6a6bc1", "value": 43767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083748, "uuid": "e4788602-9448-4b23-a16d-cdae61b04ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083748, "uuid": "06e1d8c5-e4ef-4047-8e32-9fa7c7bc38c9", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0595e823-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053696, "uuid": "cdae42b5-49d0-4212-887c-10b03a031add", "comment": "Malware payload (Mirai)", "value": "b11d5da0544b167f884152cac3246dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053696, "uuid": "f9c453a1-fb2d-484e-a4a0-fdbc921f3499", "comment": "Malware payload (Mirai)", "value": "7a92c824cdd79eedb38c110651ded7e190852eb10ec5e631737cca61573f6b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053696, "uuid": "50066bfd-4bb1-4be2-96cb-628cb594e247", "comment": "Malware payload (Mirai)", "value": "100850eca206bf57d189f2e5fd1f0238ece8447e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053696, "uuid": "15384ebd-6e4f-4d3d-a1e5-ad763581d21b", "comment": "Malware payload (Mirai)", "value": "d1d629cb813fe671561fe0055162e0172efb916e09c3699256b2d30e22111ae1c3755e28b25ee3dc0a4136f060087e79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053696, "uuid": "a83b888b-4174-40f7-a448-71f65a3febf1", "value": "T1CBD35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053696, "uuid": "60314b54-34ef-4cca-9992-5d70fdc27d65", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQG:yIRfe3xvvSrlvZZ7UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053696, "uuid": "a06ceccc-68f3-4b93-a5cf-946283c8b3e9", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053696, "uuid": "1d739291-ec2a-41c4-9dc7-bbeccbfe98ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053696, "uuid": "ad024ae5-4c87-4afb-a883-69a961e8d1c7", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45413a0a-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053373, "uuid": "659e7027-36cc-4ab9-844c-269bc95a42d7", "comment": "Malware payload", "value": "ce0eb1fb5b7dfc6af5f16ecc46be0421", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053373, "uuid": "802b2d1e-e42c-4c13-b0ed-231ad7b99ac0", "comment": "Malware payload", "value": "7b347cdcf37ef16e9ea43c495630e4736cfb1f25afa152cccdf5a31065e870f0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053373, "uuid": "981e4338-4442-40e2-b409-9fbee0fec63e", "comment": "Malware payload", "value": "b3c0d52b416534a393c7565be2cc1c76da1f2e03", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053373, "uuid": "c0a96ce0-05e6-4a29-bc21-93e6dcb05022", "comment": "Malware payload", "value": "c1426ca75ee43224e4fc4eb6175348681f63f00b55b8b66f7f17a86efbfc752371a5bbb4d4158aef53a495412f8dd8bf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053373, "uuid": "f8362fe2-be6c-4f23-aa92-10ee9edf8578", "value": "T17E6733B7958DAF3CCA518D3628BC6F2C00DB3510846AC05FC29CFC75A593E4ABE74699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053373, "uuid": "2b565af7-6685-4473-bff0-8cc8eb6b2666", "value": "786432:ktJY6HUrxadrBGH+qdlLzUG0qBWwe23oMzdeTVP/IHrmT:mY6HwEQz30qfr3oMz6N46T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053373, "uuid": "be9a3ac9-6f91-4b35-9b39-0bbd8879e352", "value": 30676992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053373, "uuid": "d55296ad-933b-40a3-85e2-c11a2c557580", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053373, "uuid": "acc82396-91d6-46f2-ab4d-58894308334d", "value": "droveqx_menu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7df140f-2dac-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775035526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035526, "uuid": "98b0f844-73b0-480b-b82e-e89cb78ce863", "comment": "Malware payload (PhantomStealer)", "value": "c1f60b973910e092e435c9d5e0482923", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035526, "uuid": "8b33d278-02e8-472f-87df-a229f94a97c0", "comment": "Malware payload (PhantomStealer)", "value": "7ba23262eb087a6d515ae54a3d2cfa0339d102fbc6a52520289d81c6d595b502", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035526, "uuid": "c98d2d03-c503-4531-a3d7-1617fe87d220", "comment": "Malware payload (PhantomStealer)", "value": "6b15bc0180888c84252a3bf4de40baef278f68a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035526, "uuid": "513ee481-3714-4728-9805-0079fc555ac7", "comment": "Malware payload (PhantomStealer)", "value": "01fe794ae15ea722f4944fb06be5abb7b79749f7b79e84350aae7207d23684fd5037423a51232f1ce38a7f171d57e140", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035526, "uuid": "3299bb1a-b754-4e97-b82d-71ced3ad07cc", "value": "T1E8B62A99E7244635BB92CFAC5A35DCE0E94A134319C9CF20703DD61C7B6E927E3680DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035526, "uuid": "d7981157-ed5e-4be6-98dd-6eb85c75f518", "value": "196608:/uDYqr1kntQH2szUHhULKaPhLyw7K2tDxNd9dDHzk6FJPnfrTF/jIw1hoWOWO9pO:/Qbr1wR2pDbNDxNd9dbdXPnf3F/YWPSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035526, "uuid": "527a142a-7204-4b94-aa19-02da7cf25762", "value": 10718071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035526, "uuid": "e6943ab0-ceb0-4943-b1b3-3be541941737", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035526, "uuid": "d4f92cee-4380-4e8f-9cd1-9818d907b9f4", "value": "sorgulama_siparis.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b99cc0-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775041432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041432, "uuid": "1f42024b-b344-43ad-9485-194a263a022b", "comment": "Malware payload (CoinMiner)", "value": "81c0314ede19bf287b09c7d2699e5c7c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041432, "uuid": "c1e09bdd-a6b0-4a23-b813-18f7ceab2918", "comment": "Malware payload (CoinMiner)", "value": "7c806f73aaca52b4030b6b996ae0b71452e545d08b38543d8885210037cfd02b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041432, "uuid": "7d0a69d1-e1a7-4ca2-8cb5-aae626d056c4", "comment": "Malware payload (CoinMiner)", "value": "96a6789e494c3cb3f43899e3cd300c1b0e6acc33", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041432, "uuid": "aaf4eb31-601a-4c7b-bacb-d87e8e44da9b", "comment": "Malware payload (CoinMiner)", "value": "0d3451b7cfb922d5d435fbcbf545f53183b856987820fcbafe450c2a99f282b7a3b43022a4a4e5edcab488018fc20be8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041432, "uuid": "16967d3d-8aec-4cbf-b5f2-0f0984dc9a63", "value": "T1409633E997F44CE6D877A53F59A51152D3B1F4220760C8CF1BA0832A2F9B2FA2C35794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041432, "uuid": "ff9072f5-fd39-4fa0-9786-f99166e909c9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041432, "uuid": "3e2080de-1380-4adf-b508-abbeeb43a348", "value": "196608:LoVrC4tbW897GXPHMe81SF2RPUewq97BtKZ2sHsMRqubRgFtDU:LerC41wPsZg2KezxK4sHsMRqubYtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041432, "uuid": "2cbd9563-f2ea-40e6-b3ae-8f2c2524094a", "value": 9333972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041432, "uuid": "ee07a27a-4628-4474-b48e-7433c9c4cf42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041432, "uuid": "6a5940b7-50fd-46ca-9564-6befd2c70238", "value": "NovaHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8106954-2daf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775036788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036788, "uuid": "5bc16edc-7556-4fac-a459-16cccfdc599b", "comment": "Malware payload (GuLoader)", "value": "e9ed197f5cd594c94161d495b537366d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036788, "uuid": "81ab717c-af88-4cb9-93b4-252d2f4f3a9c", "comment": "Malware payload (GuLoader)", "value": "7caf17952f2374c498ef836dc12f8894b88568d46ab0e80789984847cef511c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036788, "uuid": "c9c1a706-b6dc-4da9-9e96-b91a0850795b", "comment": "Malware payload (GuLoader)", "value": "3d77c5d5142ccd8eed312adc61cf75a992c91361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036788, "uuid": "6b1bbb9c-d4e9-4c90-8918-111f24573d79", "comment": "Malware payload (GuLoader)", "value": "ec25c38854f2c47cc9db5e4f859892f06662573d0dd818cef27f797c7e3f524a5739fec2a423cfb737f8803def7f4107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036788, "uuid": "b25425cc-e4ca-474e-b1ac-b9c292dd68f5", "value": "T150C402073F00D563C9984B31992AD6B5A7717E162380EB0B32D87F7B3EB72826D1B156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036788, "uuid": "d34a63e1-d583-4722-8ae1-a2c80410ed60", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036788, "uuid": "92bd2336-f0c5-4e39-a131-fe8d267bcdd3", "value": "6144:VhRqd7s0BLf44CfJpieK46CyiO3R/xv4cDLJE+PEIW4leB9pKHgNikvFJ1cVXijI:PEch/K4OPh/xv4c/yOEIkAHgbdcMt65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036788, "uuid": "e2a42615-389a-4112-92f2-106165e9099b", "value": 580060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036788, "uuid": "a40c632c-e6df-439f-b8ee-1acd0cfc8620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036788, "uuid": "0dfc7dac-02d2-464c-995e-24afef93fb0d", "value": "RFQ-2026-29-03-Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff5a381-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041929, "uuid": "312cd5b6-ddca-43ac-a37d-344910f02f0c", "comment": "Malware payload (Vidar)", "value": "7646361aa28992e754ca66f9b06fcfb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041929, "uuid": "eb935b74-c0ab-462c-b95f-983f30d09ca5", "comment": "Malware payload (Vidar)", "value": "7cea38ad33776cbbec7b0bf9a088a4644005d8f613c7fea8d537e54681fc2cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041929, "uuid": "e5292cf9-0104-4cca-964a-d5f3a61d7c56", "comment": "Malware payload (Vidar)", "value": "7e4e486e4a69c968ad7343d23146e7b6f7d64d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041929, "uuid": "12ed2407-34f5-46ba-881a-8354eeb928d3", "comment": "Malware payload (Vidar)", "value": "38fbbe149bcecc001956a8fd813f5e19cb910792da6770bce50a6e0b49d8e6a1c09d09afc032e282240e8162a5f6af94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041929, "uuid": "9f06fa60-9a91-4f95-8e95-1ac527e706b6", "value": "T179F63BE2EE50077AD69BA33ADCA2524A2230F145133114DBBA9417565D2BFC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041929, "uuid": "1b115e42-b8ab-4c11-8f19-0837db982429", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041929, "uuid": "00908837-39de-4387-8cf3-1ce698bf614f", "value": "49152:KN6Ydq+lRUJjSIycfUwJ38j9DVHYrW2KyOAYJGaETs1DR3bOkOKO0OKOpOKOOOZ6:KNMlflJ3vVa6asUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041929, "uuid": "c376175b-b492-440e-8e91-31bc3488d71e", "value": 15960704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041929, "uuid": "104bc327-3d88-49e9-a4b5-a07672a075a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041929, "uuid": "8a51f58b-583f-4569-a5c0-e5abc61e5494", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120d4b51-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053287, "uuid": "138fcd1d-c09c-47c1-80b5-7dfd6b6ba79a", "comment": "Malware payload (Mirai)", "value": "9ec65b3f9b040a1d3b0276ef0f44d5a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053287, "uuid": "7707d4ce-31f3-404b-8a64-80e83f27ee8a", "comment": "Malware payload (Mirai)", "value": "7d4df570e094bb96a7ca39ea0581544658c287840708386729de73d0397b0c63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053287, "uuid": "7f0fe371-ce7d-4b3f-94a0-51308eb071cb", "comment": "Malware payload (Mirai)", "value": "4b002bbc018f1f5cc159ef9468d6676431db4c6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053287, "uuid": "d3abc66c-76e9-493b-a166-296ef77c28cd", "comment": "Malware payload (Mirai)", "value": "c998f495476c163e2e24ba08acb7cff0b4781fdbe5e2e835b8702f3ee178e8d04f25bc7369215d8032a297a2b86f31a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053287, "uuid": "693aca60-99f1-44a1-b712-fb4382e86ad0", "value": "T1CF333A35B6752A1BC8D8987D22F74328B2F4168E28F8CB1F7D720E4EBF6085025176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053287, "uuid": "403bc4f7-ddc9-40f1-b25d-fe018618bade", "value": "768:vj72UF999I26p/d1DNwm+BW4HpX2KlNhdtBBY3hju/QJwO+351TSOj:v3pF1IDp/nNwDBW4HpmKlzB+3IQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053287, "uuid": "62c7dbad-60df-4d06-8358-a34d609f7ae0", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053287, "uuid": "39622925-d746-4911-a41c-a9f870b5c944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053287, "uuid": "7e2a3e6f-4566-4ead-bcb6-79d36735411a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1973bf29-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041703, "uuid": "713db655-13e8-45e6-8b86-94b262ffc318", "comment": "Malware payload", "value": "df43394b926e609e6ad020b157b151a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041703, "uuid": "5aa51110-98e9-4542-89bb-6d412a2e551c", "comment": "Malware payload", "value": "7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041703, "uuid": "029819d1-103f-4dd6-86fa-4b4561bf73f4", "comment": "Malware payload", "value": "7f63db03c90913b90c6972fabd77c9862cba917f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041703, "uuid": "d6ae2871-f31e-4fe2-92fa-d74413696797", "comment": "Malware payload", "value": "8f438f95a1b95a0e246ecbd1b19745c91e1f47c219a99cc75292b7fa07a352ace1c2bee59de806c077214ec67616ed1c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041703, "uuid": "39b986aa-ff79-4f70-9330-761fecf59a27", "value": "T19702A53616FA123139A6CAAD2A0F90117A66F403321CD544B7DDB3889FCE554E563BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041703, "uuid": "4a434afd-2b7b-4ebc-8e01-db58fcafc979", "value": "192:bmwBGtNAZRWNEbTIZC6/FJrenalqlB2SOyys72:bmaZwexarenOQK1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041703, "uuid": "1741c34f-ca1d-4345-a797-085766ceab31", "value": 8942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041703, "uuid": "16b72524-1362-4ab9-9b64-a0fb8f2de967", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041703, "uuid": "50480261-a30a-48ce-86e5-23b759dc2087", "value": "7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b967403-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080818, "uuid": "ae9804ef-f2cc-4609-8028-6a09ce6efa39", "comment": "Malware payload (Mirai)", "value": "5c632850d085307c6316c7d9ba143dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080818, "uuid": "97f0a42e-485e-42e0-9c33-76013204f12f", "comment": "Malware payload (Mirai)", "value": "7f03ee7bc285c68e5b52d97617aea266887d944108657bb2c054d78bf84538dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080818, "uuid": "2eba62a1-230a-42fc-825f-3531d9fc1754", "comment": "Malware payload (Mirai)", "value": "ea411341405514978dfd78a8f74d89fb9143fcbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080818, "uuid": "d651ee6a-0cc5-48da-b58c-8559e8aeb924", "comment": "Malware payload (Mirai)", "value": "58bbf20627feafc317b622b6966bd1c68086a677416140dfce8d3292d1099c4adc43debea14efff06e465b9cc5f8481f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080818, "uuid": "2f37875c-60c3-48e2-8644-ff35a2a04271", "value": "T1FD843A23FF0C1432D8A39E756D7B2BE59339E8E16175E11954096F2C2A31BB0698B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080818, "uuid": "ed393f93-1170-4e37-83bb-82d9b933d654", "value": "6144:k5Of6ZfiOqbOLxfOy8Wfwjis9keQBbJZD3Tof4+IZw5Rd8VQn:Jf6COFOSbtTyIql8VQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080818, "uuid": "df1279a7-f721-4d73-8cc8-253737082cfd", "value": 379828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080818, "uuid": "0fe8c09f-d08c-4ff1-b4df-620d3d79eb35", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080818, "uuid": "29e15afc-32ec-43cc-9793-0af87b7a14a2", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48441c76-2d67-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775005704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005704, "uuid": "fd80a21b-d4fc-430c-bfc8-98d47be91e0d", "comment": "Malware payload (ValleyRAT)", "value": "b3ac5b8ad359084e9fb9c55bf561e814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005704, "uuid": "e77cd40b-7bec-4adc-b97d-b7385309c200", "comment": "Malware payload (ValleyRAT)", "value": "7f707cb02409b31b80cf4428fbc882cde513e20d105391b8cec298940579e23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005704, "uuid": "037447f9-2b54-4c82-98c8-350b6bb891d3", "comment": "Malware payload (ValleyRAT)", "value": "e308bffe6503127d078c76a139e89c8c5cc5bfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005704, "uuid": "d32d40dc-80a0-4ef5-9045-0d49048ead62", "comment": "Malware payload (ValleyRAT)", "value": "cdcc05df56eecb87deec82efb2245df4fa50d07c57ba95a68ac11791ef6d2919d44949cb2a7da2162003c235e1684423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005704, "uuid": "8ea2df1c-63c2-4ee4-b67e-ff9c1310789e", "value": "T13DF58C83B2B65364D9B7C23486A7951BD6727C068F2066DF125CB7592AB36F00F3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005704, "uuid": "de35af36-67fd-4fdf-abc2-f8b9e9113f61", "value": "9248b3c5b16c1df2706eb88158973504", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005704, "uuid": "10fda73f-ad3d-4b7d-9746-62b8562c96e6", "value": "49152:R00Oqwi5G6RSIye77wMCpaWZOwGhdJifru/BQmJsv6tWKFdu9C3PTvG7WpHFhh6j:JTAyJ6XmJsv6tWKFdu9C3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775005704, "uuid": "74c6dccb-dc0c-463a-9d1a-14852f421239", "value": 3569664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775005704, "uuid": "a3c764ab-9529-4dd3-a08e-a7348a12b0e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005704, "uuid": "3f643698-928f-423c-ab65-63a82dcebb25", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d068173-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775045789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045789, "uuid": "faab3059-e3e5-4c8d-8637-a5dfcc45250b", "comment": "Malware payload", "value": "6e657e063ebbc9598325e513dbc69c7c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045789, "uuid": "1376d029-6013-4224-85b1-ef7ce5bb061c", "comment": "Malware payload", "value": "816fd294fece9e4f049ffd27ced21af4ebb7cc2691cadce39cc51c536803bddf", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045789, "uuid": "98c0ba14-2bc7-4b7c-a859-0cbd68110375", "comment": "Malware payload", "value": "d5f3d2368a96a25aa07b155bc3a3365fe53db44c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045789, "uuid": "6bf67d2a-c8c1-4961-90f7-97c6d9dc9edd", "comment": "Malware payload", "value": "e00f18c22a4657cbf32eea4e3a83257a25743b449648a3cca44b99285d1515eaf08a37b2143c52614cc22c84535b0355", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045789, "uuid": "97e31531-0156-4d06-9615-f6e4e85aeb7c", "value": "T19BA4E82294F9113DB027C56263E3AA1A6729C413E41316FDBF9D67548FC3C9267BB20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045789, "uuid": "6d0f445e-f028-4ac3-9c62-993c33f98722", "value": "3072:qbOCiL4jWgAG/UlTwMh8Pn23iMWzTRwn4JIUBqXQNGjcs6edWC9S/JdB:4OCjWgAGtMWzTRwn4JIUBqXQNGjcpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045789, "uuid": "e92e32df-a472-4b61-b0a2-c64113e000a4", "value": 491338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045789, "uuid": "aa34f9c8-4327-4f6a-b1da-221ed9a2b685", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045789, "uuid": "aa717396-4380-400f-801e-f363f5de8ab9", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f00058-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064318, "uuid": "22d278a1-dc3d-44d1-b865-f4ff5c09d4ef", "comment": "Malware payload", "value": "574e3d914d16f5d823223aac794ff33b", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064318, "uuid": "fb880c19-228b-4412-b327-f1f998f5b2eb", "comment": "Malware payload", "value": "81cd5e2250d507c5c457612fc5d86dbb5ada6e288d6cc66e9cb62ee6ba086a00", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064318, "uuid": "05f4eeb6-60e4-454c-8377-a097875f7505", "comment": "Malware payload", "value": "359e4b0e3b5baf3df74ef38ba56dc818686ea75e", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064318, "uuid": "ebfe74d6-0fc9-40f6-a848-70036a17a894", "comment": "Malware payload", "value": "561b473ef321bbd9433f50be3f901b6efba6e79fe4ea7822ef424072ef029cf1fe07c9a5a985cae25d9b83f418730602", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064318, "uuid": "cafd299f-8b00-4ec0-9e9b-7bd3e9e8015b", "value": "T115E63322832AE455DD772B7839BEC30AD92E85983B06F6CF2E770A6D6C815D0471B70D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064318, "uuid": "d846251d-7a91-47a0-856f-40cbc35002d9", "value": "196608:XSNI3rg2DDB28b2cUk2tf6/ohxc/bmLrOLFjQR6Hs5JqNx3Q8SDURdDOGAXUR4JU:RbDVHb2crwirbmL0tEHUx3Q8SDUH4E8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064318, "uuid": "379ae37b-6d54-4bff-8d7e-811985d078fd", "value": 14579537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064318, "uuid": "3dd49443-c5c7-4077-be43-cc1a8ec5502d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064318, "uuid": "2ef502bb-8f62-4a41-9b1d-a767b3be3591", "value": "459629.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1e9672-2dcd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775049784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049784, "uuid": "d3613832-1484-4234-8b21-884cd49d3c79", "comment": "Malware payload (AgentTesla)", "value": "ae226a1575515af7e3006e5da75664e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049784, "uuid": "6324c4e0-21cb-4319-922c-56403936860e", "comment": "Malware payload (AgentTesla)", "value": "81d9e0389970009a15ed35e003f8feb500bcb1c684b7a6b16d4fe9fc028a1abc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049784, "uuid": "c4a01aae-d8af-426a-b231-6c3a71a00a2d", "comment": "Malware payload (AgentTesla)", "value": "1f96e760d619117d3a71a21f1465b6a5fbb93b50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775049784, "uuid": "5088b544-dd3c-43f0-9e9c-a7e683913ee4", "comment": "Malware payload (AgentTesla)", "value": "a109f4f4e78babdea0e31120183ca3ffe56fed2f820d0dd61199e3ed641cf557f341339d8839420da1623a5b6f39b278", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049784, "uuid": "778443d5-2f99-45b0-a4ae-43acbd08a7bd", "value": "T115911AF55B480C93F99385F6E84F7E7506B5F6BBC8CB22A8971CF4E24D6B2325012505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049784, "uuid": "7e48a91e-8349-4f61-b0ed-c4b0fe0181c3", "value": "96:U6CA7nc456+Shhv1LKiFg5fu40AOTf1JnOMXqYpvlIR+HjAbp:U63ncqjCJ1GrNdu1JnrVSoAbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775049784, "uuid": "4071df82-8712-4cce-b3d7-580151e2baf7", "value": 4422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775049784, "uuid": "ba21ce42-ff04-4a85-8d30-39f0c23840d2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775049784, "uuid": "a62fd425-61bc-4e56-883e-798b8393ad31", "value": "invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eb4d16-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1775053585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053585, "uuid": "d79b7636-54fd-4255-893b-ef7dec018fa7", "comment": "Malware payload (N-able)", "value": "b8156d5eb9ee3f4712ed8e5f757d7ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053585, "uuid": "0c2d4601-8d70-4221-80ef-b8c7d8790990", "comment": "Malware payload (N-able)", "value": "81ef9cd746087f87b29df8201878e5ca17043ae800906b746c9ddc8d45f3ae93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053585, "uuid": "47c7b7d2-0b5f-456f-8a6b-c5bfda8da800", "comment": "Malware payload (N-able)", "value": "50eae575bc9ed47d9f1765a657e9af2ffba8ede6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053585, "uuid": "4a753830-85f6-42ea-887b-adeb5d1f1b71", "comment": "Malware payload (N-able)", "value": "1ff59b8f4cd6041b74cbc706a3f491f0cf9f3fabb1c3b082977e5c233c347155aea742c7fcb969e286c181ff282c14d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053585, "uuid": "c0190c4d-5748-43ec-bce4-adc6240a1f97", "value": "T196E633527D88DBBFD4212770C6429BB7529B7A744810186B6F0C1CB66FB28CDE528F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053585, "uuid": "62c2ddaa-2a63-4a91-8107-674f73407502", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053585, "uuid": "3a44d4d1-5a70-429b-b7e9-5f7c82546584", "value": "393216:SPF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1V:grRxvoC/7a0jUxX7h1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053585, "uuid": "d99cc050-1442-4c54-8d91-6ef97c176d18", "value": 14782048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053585, "uuid": "b6eda9bd-c11f-4669-8e71-a87aff32807b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053585, "uuid": "e3f77215-dbf2-466f-a594-cc00072590fd", "value": "FicheiroOr\u00e7amento.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3e8623-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775028499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028499, "uuid": "a2e00f12-8777-4d3a-93da-4d03b835460b", "comment": "Malware payload (GuLoader)", "value": "8b31419815199cd782abb48101453de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028499, "uuid": "d236c643-e1e8-4c81-965a-d7b4524e1e4b", "comment": "Malware payload (GuLoader)", "value": "8215d72b035712813355054c59dd3c4a05c981899ac47a2614790fe0d8340d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028499, "uuid": "37ee9b90-3ecd-48e1-9544-c3a14567b89c", "comment": "Malware payload (GuLoader)", "value": "7e1be8a03b90d558c26c8e49bc3b07e9ee2e5565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028499, "uuid": "086bda3e-ebda-4ce9-b72e-2f5c591d9009", "comment": "Malware payload (GuLoader)", "value": "1093432c15b9b110660538e36208ae30a9af1bfce28cde8c39ff948c2465d617761d8d9fa110cec04a693dc7d36e11ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028499, "uuid": "6f955478-f39d-4b8e-92f6-84f394ef5bb9", "value": "T1BE3412B63694C147DBF608708CBADB771AF296B73470964B2320AB1CBC51652DC1FB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028499, "uuid": "f1a4256d-ec5a-4a1f-bb47-7d90a6ad51a1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028499, "uuid": "da5ea8d8-0e32-4eed-ae83-46bc47536d47", "value": "6144:YMm4CCNUQdPoqBkKqJwNtKy2wZZmlZ5MblG2Bl8d:YMwaUQZRSwNwy2yU5WP38d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028499, "uuid": "60619a96-58a9-46d6-b013-ddc594e332b0", "value": 245928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028499, "uuid": "3c3152c5-7ef5-471d-9596-ff4e42242398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028499, "uuid": "cee01ff8-3a7e-45fb-b29d-19723415ce56", "value": "Scanner00928377465310326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb89d265-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022674, "uuid": "9edfc799-55c5-4c71-b6c2-8d76c016a24b", "comment": "Malware payload (Mirai)", "value": "250f5ca16578fa5d6becff3306092c56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022674, "uuid": "fc8b1ca8-4694-4954-afdd-149f1f7c74df", "comment": "Malware payload (Mirai)", "value": "8221d526fa678fec87590cb98767ca21cce09930dfae8701062db22083a4418f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022674, "uuid": "e56a58fd-814a-403c-bd45-69f0a834758b", "comment": "Malware payload (Mirai)", "value": "6c273a6973ddf101e528871668bbe734a66bb519", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022674, "uuid": "90b4af3c-a174-49cf-9e61-8cb72882705a", "comment": "Malware payload (Mirai)", "value": "1aae5db937eec5456d5c562f2e60d7a7d709f06625c3c3f84668d0be511129c0344bdbd864200196542fb003217334b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022674, "uuid": "f47793c6-f51a-4ac2-8a91-cafca364eab8", "value": "T1CEA2D120469739B2E5A5183D9578C58756C7A6FCD0FE763A201002A8F3E485729F73BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022674, "uuid": "83a213ef-e4fb-46e1-b3a3-c034d6262874", "value": "384:KI5FmlFCnLS78BDfOwgp48HTmKN6nX1kYz6z+yIhymdGUop5ht:KIXu8AJzaleYCys3UozT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022674, "uuid": "e72cbbee-96b2-4a60-b80e-c90c13d6529a", "value": 21532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022674, "uuid": "83d05ebf-b60c-414f-8ebb-a96f8292f67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022674, "uuid": "03a3c86b-d145-4503-ad4c-9ef3976a1ca4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903d14cd-2e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078409, "uuid": "a7797652-a07e-4401-84e1-3557636f8395", "comment": "Malware payload", "value": "201ec39ba4d13ca0a7e50b0ac11ab744", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8305", "colour": "#4C55F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078409, "uuid": "afddd456-055c-4b27-a350-e497c0836779", "comment": "Malware payload", "value": "825c879e7fd5bd8733f720b82a4fb368114fdd475c15d8cb8710cb51cfbe7b52", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8305", "colour": "#4C55F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078409, "uuid": "23fd7feb-b1a5-4148-a132-9a1437f462f1", "comment": "Malware payload", "value": "49a196b2fdc63683f51d6647343a98cfd4c14f16", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8305", "colour": "#4C55F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078409, "uuid": "ceb1f855-b13b-4559-915a-26682234afbd", "comment": "Malware payload", "value": "708b41eca02a1b99910bb3567b72efa610cb55f9fed3901e70449ee5ce40551009dfb3dc3800b186c80c0d0878bdb833", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8305", "colour": "#4C55F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078409, "uuid": "af84b851-01ce-4787-99f5-c93feb36324b", "value": "T1340733950EE86265BFBDFE5504584C2F772AE1C37D19FED879F802CC27E580869248B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078409, "uuid": "22cf42ad-68b3-47de-8dc3-3034b05a3b20", "value": "393216:Bmisu6XrTZ8GkZ2deiJ2XNjWmI4gn5AGjZ6n6Z/OTf2Pfw6BMPyEB:BCu2TZ8GkWl0XNjr25AGkVTofs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078409, "uuid": "4985fab0-89fc-496d-8092-1aba46d54f92", "value": 17060323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078409, "uuid": "60632429-547c-422c-a6ca-ba50758cba80", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078409, "uuid": "01893bdf-0d8e-46a4-a6c1-1d8038369c70", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae9578-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039195, "uuid": "e1ff1215-9240-4c22-97a5-7c5905a9a737", "comment": "Malware payload", "value": "4661b02c7fdbf57ae5f4d8620ef5f54c", "object_relation": "md5", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039195, "uuid": "08891c73-0cd8-497b-b2e6-a906481c6f94", "comment": "Malware payload", "value": "82c7d4123b47bbc4b6d32a52521db81d4b1580a485c6e6bf508f32878bf53223", "object_relation": "sha256", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039195, "uuid": "15bd3ab4-be6e-4e66-8fc3-cde9396b8294", "comment": "Malware payload", "value": "5cb2ccf153a5ea8f8b1d85db74288779fef8d6b5", "object_relation": "sha1", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039195, "uuid": "d35ef15a-6d86-4719-adbc-a51df520258c", "comment": "Malware payload", "value": "c289f7dbb46b0898111b66743f3fe620e17c6e87f7f9b2a42bfd1a4f5d508bd29aee217ab4cb8b1f6b6b7b3626442357", "object_relation": "sha3-384", "Tag": [ { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039195, "uuid": "efabb780-c1ee-4a61-9410-6493aebef8b6", "value": "T1CB0110FE783234B25F43C5EA9D5351D60976D3BF1BD02DAC28E6873458AE050E12222D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039195, "uuid": "3ff32907-62c7-400f-bf66-f130a30d0a84", "value": "12:SZO997dG3BCFrCR5Va7hFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:KO9xdGxCFmkt1EDlgNjTidGXhGIBFVRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039195, "uuid": "62f01c15-c367-45e9-9c02-2d079c5549db", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039195, "uuid": "ca46ef00-eedc-419c-89d0-a0fe0b48267a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039195, "uuid": "bee46028-633b-4921-90d9-c7382386524b", "value": "82c7d4123b47bbc4b6d32a52521db81d4b1580a485c6e6bf508f32878bf53223.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a638a853-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775039792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039792, "uuid": "364cee68-90fe-403f-a973-4b71e3de5571", "comment": "Malware payload (AgentTesla)", "value": "0aec094b3b1ff45c3c0c8d385ac4b8e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039792, "uuid": "251b8722-7ed8-4cc5-b5f5-abebdc87c67f", "comment": "Malware payload (AgentTesla)", "value": "830e7555a21ef8eaf7c0476595d116806d5351e5e6d1e458f10cf9e7e93d7dd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039792, "uuid": "05e71989-9794-4201-b69b-8a05caa55034", "comment": "Malware payload (AgentTesla)", "value": "bb9ba0814a17fa6fd0cd02df32fa461409a511c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039792, "uuid": "d3b0e194-af47-4668-b5b2-9d12abf16b45", "comment": "Malware payload (AgentTesla)", "value": "1f3336aca29731b5c43efdf1744f268d5fe8685aa99f13e13066636d708a4129613e0b462a683eb6be8c4d3b10f7ffe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039792, "uuid": "1d0f1b2b-f749-4995-ac40-fd7556d5c338", "value": "T17345BF0273C1D062FFAB92334F5AF6115ABC79660123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039792, "uuid": "9c7028fc-a745-425b-a312-1a177e219cf0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039792, "uuid": "52978e7c-8770-4d66-a66a-d17ebec09b2f", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdayqDZhcobdcVF3oyf:2PVt/LZeJbInQRayGcobde4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039792, "uuid": "30c1087e-c0cb-4776-b631-b8fb38a46a3a", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039792, "uuid": "939bd75a-d1c8-4b15-82e8-afc014299597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039792, "uuid": "57674f83-21f4-4643-9d1a-a60d6cbe9ba1", "value": "DON KUL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3206c2ab-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775057636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057636, "uuid": "24a57058-5798-4676-a997-ccd7781de8fe", "comment": "Malware payload (Mirai)", "value": "d6bbc2535eec233548e0319bd7b49c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057636, "uuid": "e1ebc53c-2159-43c8-8105-de3dc11a8fc5", "comment": "Malware payload (Mirai)", "value": "838b326d32b16440811c1b113abfcc0ec1fb54211bd2abc898522329271348c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057636, "uuid": "79443370-c20d-4a52-9736-01d85e3f0422", "comment": "Malware payload (Mirai)", "value": "697f4f697af7a435993efb927304cc38726eca4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057636, "uuid": "68292969-6557-405b-8f5c-d012520ecf84", "comment": "Malware payload (Mirai)", "value": "b87b9b2aa9a0c146a9f9a0100a4031d70be6e08638f3e34042039c6c26ce9d7a70f5c654f0eb5db60c7bc10ca0669090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057636, "uuid": "ad0fe950-2315-43ee-90f8-231d902a426a", "value": "T1D0C43959A8419791D1D02BBBFF1D934873131B38E3EFB1069D196B246BABC1B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057636, "uuid": "6f8b22d5-42ec-47b0-af8e-2ba57521a48c", "value": "12288:HA3uTu2OFxo8HCe6mIE3KqR9h4P46y3oRgg8enKHaMBk5gD/TDdehW:U6u2X8HCGbh4PV2gg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057636, "uuid": "ba5ebb39-2cfa-431a-a8fc-2996c8abeeff", "value": 548100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057636, "uuid": "3f736187-86d4-46a0-a08c-4d562d41e608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057636, "uuid": "eaac7428-54ef-4f66-a7bd-914c11df558e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80aa8272-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039299, "uuid": "f2220e97-8488-4a43-b900-09ee0046d452", "comment": "Malware payload", "value": "27423746f76e5e6ea4922b899ed91dbd", "object_relation": "md5", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039299, "uuid": "09c972bb-5b9f-480e-aa2f-5062655c2793", "comment": "Malware payload", "value": "83b524467cb1eb5c4807b0f4cec93c5efe6f3b1bbd15f711f4462b15706b863b", "object_relation": "sha256", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039299, "uuid": "808788b0-5b98-479a-a9e9-5054eb9fd926", "comment": "Malware payload", "value": "0c0a8d29525177604e09924cfbf88eb011b4f317", "object_relation": "sha1", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039299, "uuid": "4e77bf55-031f-4f8b-865d-af55fe4f306d", "comment": "Malware payload", "value": "08661871deebe436cb814ece51d5d15c3a3c0f056be208fd5cf4f00d5f2b7581403a695c22f3f9d863db5d8918bfc46b", "object_relation": "sha3-384", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039299, "uuid": "8277c720-4da2-42b7-b153-36b9d56dd29a", "value": "T1DA0110EF743364B26B5385EB8D9350670976D37F1ED06DA828F59B3808AE040623122D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039299, "uuid": "cfb64be1-7c5e-43f1-bbb0-11c1b119c597", "value": "12:SD3eh97dG3BCFrK/UIhWSHSbIFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB7P:PhxdGxCFwhzHS81EDlgNjTidGXhGIBFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039299, "uuid": "cae356da-4606-4f9b-8ab5-64f76cd5967b", "value": 736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039299, "uuid": "1978d73e-f6c4-4f6e-b62b-d11a913cee4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039299, "uuid": "ae5eb636-f9da-406b-bb95-dfd138a09f30", "value": "83b524467cb1eb5c4807b0f4cec93c5efe6f3b1bbd15f711f4462b15706b863b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f291b1d-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775057604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057604, "uuid": "d597ac7e-532b-42f5-96d8-0c33256392f3", "comment": "Malware payload (Formbook)", "value": "33e81ae786609b2973a95520b032e8ab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057604, "uuid": "d37c3d06-134d-4024-8654-232877d3fbfc", "comment": "Malware payload (Formbook)", "value": "844591a27c1906e6b40e18b20d55d84f06f8cde7b48de4c0b5df7337854ab2cc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057604, "uuid": "af7f20bf-3bcb-4d8a-ad4e-512246a2e562", "comment": "Malware payload (Formbook)", "value": "5215ff64d9f3e33840d1b904a1362123987a05de", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057604, "uuid": "74f23e17-cafa-4b7e-8738-c958b1167a68", "comment": "Malware payload (Formbook)", "value": "6bad6a39e1d4d036f73540ab023e348b5e763e14d798bcb4401da70d44508699ecdec3dfd94feef0173d4a997b2ae55c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057604, "uuid": "87160d5a-2e7b-4e69-8edc-85032c641c96", "value": "T117744A0253FD5118F1F35B88AA7A54614EBBBE6A1879C02C21A8140E5BF3E149DF5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057604, "uuid": "8b090a8a-f5b7-4f6f-8a27-75261a0d246a", "value": "6144:5O9q+O+ynWnQeh/RMHsJxkdaa+emaw7LcRh+Kcx3On0Dv+qIQ09dVev441:Y7yWnQ4MMJ9smaQqK3O06ff9O4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057604, "uuid": "67781818-4306-491b-97bf-703f5f544ef7", "value": 345454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057604, "uuid": "49edd6d0-f629-4342-b476-78a548efe315", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057604, "uuid": "56bc673e-84cf-4959-870c-0e07ebe57c59", "value": "doc003.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9bf422-2e12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775079073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079073, "uuid": "b5f8c5b0-b8bb-46ee-a4e5-82e5aebdfc52", "comment": "Malware payload", "value": "d4561483f1368a7a393367a1d740d619", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5018", "colour": "#B836B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079073, "uuid": "26a599ea-85aa-4cfa-8d5f-982fdf353755", "comment": "Malware payload", "value": "84cb8a562401e84f8decef0acda9f579a9f57995358cc54007e4c1b6de303ad1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5018", "colour": "#B836B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079073, "uuid": "f5b53ef5-0559-4e90-ad00-2b6e54d13351", "comment": "Malware payload", "value": "d902acc7b40f4d70ace71fd2bb7ffdc165e0d96b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5018", "colour": "#B836B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079073, "uuid": "ab39931c-d6dc-45e2-a47b-7278f6fd8fe7", "comment": "Malware payload", "value": "65327bd1059d887f9fb93ffa53011f0e29f3c0bbfd8ccf9fd9f592cfc920f27bc8a0ec0f9216ec0edcefbda97663b52b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5018", "colour": "#B836B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079073, "uuid": "4e37a34e-86b9-44e9-b550-0a95e08f1e7b", "value": "T1C8F533767588EDC08FCC0507576BBEE8D343959A0B12536BCFA11B0177EE8D9E58864C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079073, "uuid": "bfd730da-df33-40a4-8c66-bb41a0612c5a", "value": "98304:gD1U9a4Xj1/9RR1xMGxkbsAlzFUxoGkd1Y4kvdyPkgKNhIHbhGBiH:qUU4XzRT6QKJSs9xkXNOHUBiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079073, "uuid": "396ed2f0-c046-45b1-9ed1-f94419950ee3", "value": 3322979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079073, "uuid": "a3e6d330-98fe-4ae3-a4ac-08b38f74fc87", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079073, "uuid": "5d6d30c4-aee0-46e3-bccf-a774c5edda6b", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a40e73-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041406, "uuid": "a5805ff7-0344-4582-a9a8-7ec21b9d9274", "comment": "Malware payload", "value": "599a186de45023bddfb37ba52d69dbf5", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041406, "uuid": "06bc1bd2-6ee8-443f-bbee-476b258b2006", "comment": "Malware payload", "value": "84edce66f09c55bbb44754411bde4b092288d172734df62fac20d6f794b3a2ec", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041406, "uuid": "68169aaf-7f54-45c3-849d-1ba6b4f3694b", "comment": "Malware payload", "value": "d30fc9742eafc1da555915cb2ba86eff4cc21889", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041406, "uuid": "c5764cde-0928-4af1-86b7-04932d956682", "comment": "Malware payload", "value": "72481f82526e62d68f6de9b85e80ae8622bd7b0f38815ed7c7f2ce288c3c880660d947b2b42de63db3988d1611eb237f", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041406, "uuid": "b5ddc422-af16-43d9-b468-0cf704c0df03", "value": "T1CB6188D6D50706B283C3C23084629DE29FD6E85BAF1358F5768CC5649F0D436E1685BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041406, "uuid": "de93173e-69e9-48ee-beab-7b51e9ca84c6", "value": "48:6atL9r6+kG6OMCBydzR0BAnPbGaRgzlMrgpYz376E+XnzDTigEu5XK:6qLZ4GmdoAzGaR4MB8zKgE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041406, "uuid": "b7453252-8c92-4c82-be9d-8396514f12bb", "value": 3320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041406, "uuid": "7e1ce236-24ae-44f3-a777-4808fadf32af", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041406, "uuid": "365e7cdc-0950-4634-9153-bf03f9161629", "value": "fetchaudio.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee6abf-2da1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775030919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030919, "uuid": "f791959a-edbe-45d0-b26f-7c8fb1a44d47", "comment": "Malware payload", "value": "a2b489c46247fe3f8e0eb82fee1158ce", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030919, "uuid": "8b856507-a0af-4dae-a651-4e4ed53afa63", "comment": "Malware payload", "value": "85525971efd19082c5838b9afb318d03ca7ae2a9d7ad155aed74e3444b15097e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030919, "uuid": "e9ff1ca2-b815-485a-8ee1-58328e543a29", "comment": "Malware payload", "value": "ff08ef815e2b791e4a68657e932f5e3a97d20853", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030919, "uuid": "ada6f3fc-f934-4c66-b808-4968093c778b", "comment": "Malware payload", "value": "317c0008662ffb6dde95de76cfdfcc31609162ff5db21919561ff44da7a02998516d58b6b201a9b354c040321a042e38", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030919, "uuid": "a9fe6674-6097-405a-ad38-dd66928217aa", "value": "T10BB52321B6F8C4F0FA6A17B015A5975D0BB9EE15073506C7F3587A82C4BB2C2A73B2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030919, "uuid": "87bf56f8-d1b0-4451-8dfd-6e064d6da071", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030919, "uuid": "4e7ce75a-170a-48a7-8212-53755e4f9455", "value": "49152:IgwRJ9H/VDAthmIR6b8SM/KfbUhm7Y2JX9exSTMoPEfogMncp52xGXbLoA1mf:IgwRLfVsTmm6U89hTifogMn6a4LoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775030919, "uuid": "04bcfcc6-3588-4835-a4f3-c2902372cf3a", "value": 2353436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775030919, "uuid": "bae9aec5-976a-4d03-b705-1690cb5085db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030919, "uuid": "8583afa9-1827-4ffb-a56c-59537693ee9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3052b1f8-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080826, "uuid": "0f1c85e7-a84a-4b42-b216-02c3f4885766", "comment": "Malware payload (Mirai)", "value": "a712336b1318aa2a3bab640291f40d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080826, "uuid": "68688ff3-41e4-4fb9-b2de-cb1f7b480054", "comment": "Malware payload (Mirai)", "value": "88ad15a8185ee4b46fa82c310666727a25507dd972f4c051b3b4545826c42ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080826, "uuid": "9278a776-ed89-42cf-8cdd-45f1115d6d79", "comment": "Malware payload (Mirai)", "value": "240753f188364d930510a9a3e6018c2ef813c0b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080826, "uuid": "df4223fd-cfe7-464f-a56a-a49adaf99620", "comment": "Malware payload (Mirai)", "value": "487cca015e77683413ecb388efc1b9e0399a2c144652c225d173e9cc1787d6b2897a09816c5813be321dbfa28f56db8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080826, "uuid": "4f9f546a-1057-4c09-988c-2cbc5ff79eff", "value": "T1F7E31274FC2369DF9210CD79F386A996B07C5825EA36A635D23A78874F8CC591D07332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080826, "uuid": "53e2aa13-33c6-4ed1-bdaf-022fdc5728c8", "value": "3072:Zr3Cb97QN59GRRooi53U3/x+eHpJuPrns1MOOiogQq0d6o/ojZN6A2ZrZ5bz:ZrSRE0U5OpATs8iog/0d67j+XZrZ9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080826, "uuid": "a570d6d1-d7ed-485b-b942-b2eaa8bf198c", "value": 143968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080826, "uuid": "a6c60c64-3b98-424a-b1ad-7d6e92241c3c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080826, "uuid": "a837a248-ec94-49a5-909d-e8734f4474fc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00866d1c-2d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "7068fde2-7571-436b-a6b0-93417f0bef5e", "comment": "Malware payload (Mirai)", "value": "459f62d81681c69d7c8d8a2aae340639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "bc610c38-cb53-426b-8b6d-1155eb231bac", "comment": "Malware payload (Mirai)", "value": "89c6a3621bf13ceface9a14cb46f494b4eb66df89241032a57aa53c2faddd876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "8a7d3f6a-d385-499c-a1a9-0b3748da15b6", "comment": "Malware payload (Mirai)", "value": "258d4c35299d83753458da06c613d381a91e0132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022763, "uuid": "c51f2d4a-69e1-4512-b606-ad9ccf176c6a", "comment": "Malware payload (Mirai)", "value": "d943c285ce4f252d85900839ae979a1666b31a55e107e16c061de5a6011c791e5f434145f33c9e23cc8bb48d8450eec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "9f224cfe-de9b-4c6f-a97f-14622c122446", "value": "T16463A51E6E268FBCFB96863846BB9D21A64833C217D1C546E17CD7215D6028E204FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "a183c00a-c958-4301-adb4-a0f744bb806f", "value": "768:xNLe/IEedmHqdmHcniZ2vVF2WB/APnIENksNwpv5EtGS2pR4pOH3uz2zBXHS5aHJ:PLeyrHZ2P/8XWKXI2zIaVVm4x43iiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022763, "uuid": "c7c8049e-80aa-46bd-bfb7-77437ed2e908", "value": 68952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022763, "uuid": "85213657-8893-4666-8076-9269fa26bf5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022763, "uuid": "a22b9680-b4a9-46a0-aad2-9fffd82b36f6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82bb184-2dd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775052680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052680, "uuid": "b43d6342-baa3-481b-bb25-0a3daa592bb8", "comment": "Malware payload (Mirai)", "value": "3ae13a2e11fc6663a91f029b892fb15b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052680, "uuid": "72f23e33-47e9-4ed4-afd0-78134d736df5", "comment": "Malware payload (Mirai)", "value": "8a1bf2a655dc0e6c1a6f12b4aaa99d213630794df21c00530cef615e64db950a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052680, "uuid": "d8ef05d0-4f19-4c2b-b519-30452a919441", "comment": "Malware payload (Mirai)", "value": "5ed2b5348cf793135b6976ef4ff405a5f0b5baf6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775052680, "uuid": "dd578d96-efab-4157-9c88-0ec9464d85c9", "comment": "Malware payload (Mirai)", "value": "db2c738b8f42dc90100c56ca3a1b95129863d6689f69883a274a97c10ef23002475b0520372a7903ceb7aa311b960008", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052680, "uuid": "0e52831f-6421-4131-aaff-9cde403e201c", "value": "T1B9133AC1A643D1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052680, "uuid": "7f81fa59-6c14-4318-a165-d7d3764bb947", "value": "768:QQaiSup66OkEgy5oD5YQuj4JnUTeU4wQOnVspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/JnUeUDtVspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775052680, "uuid": "2009d2f5-f760-4f52-9170-9fc42a734a02", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775052680, "uuid": "af066fbb-b692-4365-ad19-07c288e00923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775052680, "uuid": "e5fc4037-3023-4920-9815-154528b148c8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79533a8-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022695, "uuid": "d983980e-2ae4-43f8-a120-655b275127d7", "comment": "Malware payload (Mirai)", "value": "d082cff4cba2352f1cbb5b9e49de0b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022695, "uuid": "525954b3-80f9-47d2-b27e-6f3036b9df85", "comment": "Malware payload (Mirai)", "value": "8a4a5cca66299066f7e750b0280ffbb6fbdacb6225f5c42f055320c347961054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022695, "uuid": "90fbf96a-5001-414a-961d-d9333001c23a", "comment": "Malware payload (Mirai)", "value": "41d00c0ba4ad7a068adc2a2fa05092b81b0adf42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022695, "uuid": "ef2ba741-a1c5-4c22-891f-ba6661700f44", "comment": "Malware payload (Mirai)", "value": "d6c1c3b6d3aff6f4497c1e6da5eeb0690e97d678ec42185aeb3603faa16c3f864c3afbdf2c6d36441cebcdbef90a9329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022695, "uuid": "b23d1d57-143d-4526-9438-31267cd2ff14", "value": "T142D33B46F7818F13C0D61379B6EF424A3322AB9193DB73069524AFF43F8269E0D53A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022695, "uuid": "ccdb2d0f-af21-465d-b7ec-8c45f0fa7bf9", "value": "3072:RGljV8DPjSb7yzPPBBZoYFek59swNz1LkM/9c36KsHW:R4jV8DPjSb7yzXBBZoYFv5rNz14M/9W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022695, "uuid": "5a76f2b7-b92b-45b0-98de-22b5114fa8c9", "value": 132707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022695, "uuid": "0311c262-b10f-4ee2-b47e-73ed9c578498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022695, "uuid": "708cabe2-6799-476b-9205-3a0b560b7167", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35a2fc7-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "f628755f-a43b-4a61-ac6a-93dfbdd45245", "comment": "Malware payload", "value": "e7807b28c8d96d66b0fd6dfa4b5380fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "6b856038-8c8d-422f-a859-e8ecd93f2ed4", "comment": "Malware payload", "value": "8aaea6dd4f70193006006dc46c9242d241771cd4804145ab78e6af433cea3a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "d8a4f01d-943f-4c1c-ac1e-756caff4f785", "comment": "Malware payload", "value": "73e905b0d58d0312a5694fc031244e550373c9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041639, "uuid": "ff4f9a83-6a18-4f81-b3cf-e11307d84ae0", "comment": "Malware payload", "value": "7abe4b7e4ec4ca958dc8a8f60f5b176999d101d92a3cca7d018e602058aa5026197bec4239e8fb41cdef000416844829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "88144746-4771-4d2e-a48b-41e0aa16eaa6", "value": "T105D5332C85CF24F3C04B45766DE6D3A4B4457E9B14109C28046AF8B3AFA9DCAA7C7F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "806ddd9c-28cc-4ed6-9e8b-367e9c03979b", "value": "777582663ba5b0c9a1abcc682c30fc18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "4545446d-ac79-45fe-8355-31169730bae5", "value": "49152:NcaIBqo4FzzfqLAyUbgLl19vPx37dAX+l37Y7CjpOI3PbiFn:NRIBB4F4AslvvPx36XE30u/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041639, "uuid": "cf99dea6-2c8a-4b46-8aa8-393d09d2159d", "value": 2935296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041639, "uuid": "7b8c813d-2f75-4e20-be51-a5da639a145e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041639, "uuid": "f26585de-a520-4e8d-8ff8-b5b0886610d5", "value": "ligolo_172.28.16.169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c49e891-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057787, "uuid": "16c518f5-988a-4c48-94dd-36a7f50f2c7c", "comment": "Malware payload (AgentTesla)", "value": "bb7a2bbf6eadbdf9ae8fba679fc965fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057787, "uuid": "899311e2-74ea-49ac-8cc5-6b51d565465d", "comment": "Malware payload (AgentTesla)", "value": "8b0b3f6815884eb2899048e83b6e496b85024abaf2931ac98f255f8207f6e47e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057787, "uuid": "0201508c-82c7-4214-9e37-c393bd1a254a", "comment": "Malware payload (AgentTesla)", "value": "19b0ae3af017d883a0f25f9b8e699749472fb337", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057787, "uuid": "39aef941-92ba-406d-b430-7e48ea7c8c35", "comment": "Malware payload (AgentTesla)", "value": "df724f43eafbf791e9bfaa90caf44476331acd5420ad1f40e1db554a303fd2a3f791443c1f5e5cbd628c814041f6e2d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057787, "uuid": "9646ac43-2438-47f8-9b0b-765f129ec13d", "value": "T11284491357F98118F1F35F98AA7A40A54A77BE6A1C39C46C25A8180D1AF3E148CF5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057787, "uuid": "b3337d91-3341-48ce-b8f2-abb6fa8ed4f8", "value": "6144:xQvK1uBGRM1VARXpU/cp7y9aHSbn77gF4vRht2RQZpNGGArkvKAL19VBZ70VYih1:xzLM1VARXpEcp7qaHSb78ivRh86pNG9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057787, "uuid": "2395445c-e35f-4923-8a26-b553136c056a", "value": 374824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057787, "uuid": "c01666fe-3b42-4008-a844-bbdcf1b2d942", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057787, "uuid": "211734d9-9384-4c95-8969-ac8d63264a94", "value": "Shipping doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443add79-2d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775024165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024165, "uuid": "564ea3f1-c5fe-46e1-a243-bda358efbcb4", "comment": "Malware payload (Mirai)", "value": "dc4362bbe0a9346a3fe58ba2193da8e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024165, "uuid": "37c25119-0f75-4a05-9683-0309509ffed0", "comment": "Malware payload (Mirai)", "value": "8b92f02ece73bd262a89f19d9f583dabb824b0fb683f2797614274341d149ed7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024165, "uuid": "3a00a5d1-be03-4ab1-b475-21578fed00e4", "comment": "Malware payload (Mirai)", "value": "a59fc191fa2d974d2330136919965533a8c6b5a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024165, "uuid": "2b6898a4-69f2-4243-8758-b5ab2a601585", "comment": "Malware payload (Mirai)", "value": "0a1ef07856dc63a8e4dd9dd1baa783c73f300ee631c97cb0d1c1cf8553b66862e81f68ebd07e5db644dfcd3a755a5fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024165, "uuid": "0af4fc1d-b7fa-4ce9-a73a-97ee79cf993a", "value": "T1ED142A46AA404E13C4D6277AFBAF424633339B64D3DB730599286FB43F8669E4E73601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024165, "uuid": "1b85ee25-77b8-40e5-99c5-66b657a4502d", "value": "6144:hIYV6IyyG50P/UrvIAnTyaJvLa84vbGbXin6M/9ch0g0fDM:h9V6ILQIATyaJvLa84Iyz/Kh0gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775024165, "uuid": "8931f3f0-f847-4ed1-ae2d-3f7a7a9745eb", "value": 199171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775024165, "uuid": "c2b9f771-5f36-4244-ae55-ce0209e1fa07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024165, "uuid": "014f692d-8529-434d-b8b4-cc7ecafd3d17", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb3460f-2d82-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775017553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017553, "uuid": "4db9d1dc-99ae-4234-822b-f8e8ef2b1a88", "comment": "Malware payload (Formbook)", "value": "c1f63fb28469d02858e8eb69cbdad55f", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017553, "uuid": "400a50be-d52b-4327-b1ac-6b9b7c51151e", "comment": "Malware payload (Formbook)", "value": "8c330b8513d504720a091399573880747dadc9ba66a7871d709b1043a44e0faa", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017553, "uuid": "cdaf293d-5fc4-4815-978a-73bf6a8e3077", "comment": "Malware payload (Formbook)", "value": "5c899a514520ac95a70ff0376fe01daaf39c742f", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017553, "uuid": "ce4d3a9e-c3e8-429e-a57c-0c6ed106bd04", "comment": "Malware payload (Formbook)", "value": "c4c7f3508d58cd693e21f0e3ea3e10add2b2cf51d6d00e540d95a9db80f15bf3763c84e72661716f5cf1c44669560751", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017553, "uuid": "f4c22ffa-36a2-4ab3-95e0-519bd212297a", "value": "T1B255337DE17A8CC5D3B067F6CC9E2D126E75B39E221FD68055EA2CCA3C4292D1188CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017553, "uuid": "10607986-c245-4da9-9d1b-31bb9b5199bc", "value": "24576:66X8cP5XyJtTj5aaS6c1pZtuvaJI1rkzsp+OJjrVz6HlAk+5Pa7Pi911baH:66X8aVwtBwT1TWa4p+ord6HlAXPcPMDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775017553, "uuid": "9446d833-a91b-415c-84a5-11082f2a1bbb", "value": 1294028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775017553, "uuid": "c1e8498e-e454-45b0-affe-730b6063c9eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017553, "uuid": "6f292033-2d96-4085-a066-816a88058d51", "value": "BL, NOA & INV BL NO SNKO020260313219.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e004c1-2da9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775033986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033986, "uuid": "336b6568-a951-44da-a1b2-ed571ea4a5d1", "comment": "Malware payload", "value": "160c57e94304800d84e15dadcf5eb9d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033986, "uuid": "8a217305-f30b-4a7e-8b39-f9635a86d43e", "comment": "Malware payload", "value": "8e590e1b1db1016f3020b08a39ad2853c50b9247fe70ef73ce3b199522dc734d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033986, "uuid": "935dd431-9f03-4261-9533-ecf14add3f0d", "comment": "Malware payload", "value": "17a860952f71da0396ac24a8a3e64fe13f9f3ead", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775033986, "uuid": "5464bc1a-f352-4961-8fd9-6527e445e81f", "comment": "Malware payload", "value": "c896ad31c12b6fddaaa1e292427b028ee3e20736214fac866194dee425b363f758f3b6ab18cfd1b0571c32e6ecbd071f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033986, "uuid": "324f85bc-c6e5-4195-b812-79120e507d09", "value": "T13554DF10F2E80124FAF70E599AB8581549BABEB26D1ED4DC44140DDE4EB5F88CCB6B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033986, "uuid": "18bb16bc-0781-4fbe-9f04-373542d2e5d5", "value": "6144:vsC0ZktqPbYH79IAwSMoHHmocTJLdGtMrRs85O15Gpq:vsCOktisuA5JuxrRsgKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775033986, "uuid": "d7fdf1b0-da23-43b2-8269-28da6dc0f0b4", "value": 284080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775033986, "uuid": "79be4e60-bc4a-4a10-89a9-029984857eb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775033986, "uuid": "239d6e43-182d-4cf5-a1d2-0c845a5394b3", "value": "PO_61006126.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c41723-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041026, "uuid": "e6a55110-d5bc-467b-a57e-e4c7efc656a8", "comment": "Malware payload", "value": "bce4b676f776c2efcd9a55fad057d5c5", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041026, "uuid": "e83c332a-ec6e-4fe0-8ffa-b10a23ab96a7", "comment": "Malware payload", "value": "8edb7d760c45558724c237a0fcc9b3606a08cb45afbdd891c3d6ba26d0ef15b1", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041026, "uuid": "e27edeb3-21bc-489f-8fa9-46348a823688", "comment": "Malware payload", "value": "f7f526ef6d3f9e401e85e35d8fe4364ddcbe49d0", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041026, "uuid": "852b3d92-ca0a-4563-a12c-641032684056", "comment": "Malware payload", "value": "c15ce93bbf4a31bc831c97ec511f93c3c506b955c781d9fb277d41991bfb74014b262c090b9ab3120f54c67a6bd33d3d", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041026, "uuid": "fc494b9d-9818-4892-a974-1f2739a2b72e", "value": "T1CB368C03B3844D69C016DA348A57DF36D261FE924635828F6BA5F30E5EF77817A3AB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041026, "uuid": "9965aed0-5f6a-40f6-bec8-8f194cae6ac9", "value": "548ff15ad08a7b8474ceffe888ef8b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041026, "uuid": "c1892bac-bd06-4656-979e-1449e26884bb", "value": "98304:nbYDaNxWizYAc5Lg0g988swT1bR72Nis8ziL/27OJKBn9uKnNoUiuHoHFVWGwPZ7:nbYDITzYA+uZT1bR7psJLe7cKBn9Lndn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041026, "uuid": "ed53bcdb-c8c5-46d0-9481-afdd9c9d3272", "value": 5061120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041026, "uuid": "11ec693c-eda6-4065-b662-a8bbb831d646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041026, "uuid": "e2ee69ae-7c14-468b-a95b-46c9a476784b", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8d3953-2d9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028313, "uuid": "3282651b-9858-4cbc-bb0d-46ca5e9cf78f", "comment": "Malware payload", "value": "1a4981c8a870ee1de172fc04f4984112", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028313, "uuid": "355961f9-0368-468f-ac8c-c51c970b294a", "comment": "Malware payload", "value": "8faf7709170f5c932f61d92f83371661237719e517ff84be276bb55fd655ff0c", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028313, "uuid": "697cdd27-3d6d-4d1f-9bad-973ec2a67628", "comment": "Malware payload", "value": "16047afdddb98e2ca7712fce9a7aa04db650074a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028313, "uuid": "7689c3ca-e624-4a98-a21e-b1c956f60c16", "comment": "Malware payload", "value": "1e6a24c6f1d0a8f4d0b7b1e8c603af557af9971cc1de3988d8bd8a6dd20358cae89daeb57f10cd86a02eaebd5eb9594c", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028313, "uuid": "1bd6f00f-6669-4eae-acbd-f4a865ea4e56", "value": "T1622401BB86D8BD7EC85C43F34963B070B25B0D479AB4B15128035BCD8D9A11E0A1A9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028313, "uuid": "154a275e-5f38-438d-9e7e-8a7f62c001fa", "value": "6144:/vHxktl5lNXlEMsBkUK1pownvPo1zFiwqUybwk9COUA9:/5ktl/NXlQBkUK1DvgdNybwk9COUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028313, "uuid": "721145d9-f431-48ae-9aae-4006c145791c", "value": 228655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028313, "uuid": "f8294f37-a421-4790-b7e2-dfbbb142d4eb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028313, "uuid": "9dd258d8-0c43-429b-a999-89bc1bd4c9df", "value": "Swift00093847372646757323637438374.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b123339-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057597, "uuid": "112395c6-616e-4a4a-a0b5-8b9601861193", "comment": "Malware payload (AgentTesla)", "value": "991bf4164445fd4c0b0e39707ba421d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057597, "uuid": "4cf112de-8b87-4e95-89c8-44564b7530e0", "comment": "Malware payload (AgentTesla)", "value": "9043f2e2e7caaf1256d9b9d0a7493de5f63c01d2ae75d2f0364a9304652b8da9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057597, "uuid": "5587bbeb-1067-4767-b8a0-c945f68bfeb6", "comment": "Malware payload (AgentTesla)", "value": "755dfab7ee1fe0e6a8c769dec04601367272b8ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057597, "uuid": "5b2267fd-3d34-44f5-b16e-4b6caaa277b3", "comment": "Malware payload (AgentTesla)", "value": "65a3ae6984da3a4c184fd13c90ec757880bdd04fb9880cc3d75274989ade51e75349b023b31f7c1e185d11c5befffc2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057597, "uuid": "2798d883-e4a1-4f7e-9264-b33f843095f3", "value": "T1BF65021289C82FA9CFA8571C80FD160E63F04A8E941B758EFB77FE46AFE7544011B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057597, "uuid": "8fe439f9-f503-4a5a-be30-4dc3af96e04d", "value": "24576:n3Drp7ad74VrHIzoMnbP2MByox4HBGK/a/ldklBVYH:3HodYLIkjtCNmjiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057597, "uuid": "5483fff8-012a-458f-9851-f7bd06f5aff9", "value": 1467565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057597, "uuid": "215f4b23-40ed-46da-9c54-7db4d6a32f61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057597, "uuid": "b55768e4-bcd6-46d5-a9df-d74f2423c1bf", "value": "Invoice No. 9296.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb7b381-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040076, "uuid": "48b7b3e3-80ad-4320-b728-3d95e7ee97e4", "comment": "Malware payload", "value": "72a0c636a90211811be12be7b35867cc", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040076, "uuid": "64ed3888-cb44-4d7f-a419-3d8ee8d4c565", "comment": "Malware payload", "value": "918b846b21167686b9d121e182c9dfec18e66b53fd1c33af1cdd1d0907e5fb12", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040076, "uuid": "09bfe45c-59e1-491a-8ed8-2d4c8ec1d490", "comment": "Malware payload", "value": "21d691e5f88b15756a774fd5378cf67a1d3e99e3", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040076, "uuid": "39817a86-eff0-47ec-b695-04af0c71aca7", "comment": "Malware payload", "value": "2f53a5dfcc4071f8ff3159d6dbf4cf1719538d3701e9e1e10a2c933758371dbf21376c63513dacf190d8cbf3e56bba30", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040076, "uuid": "48c4b264-aa83-409c-a381-a9c4c55feb80", "value": "T1C0963325B1EF71A9EB9072B81CD55FE1A39FBC3025C396714804E46A6B5DF7209E0E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040076, "uuid": "32cf390b-f779-456e-841d-4016dddd0c22", "value": "196608:kR2vpu6RAdd5ucWyJYaGXqnKK4YrKAxEH/hmHQHVfHN0UZSItqi:kR24VtJYPXACdA+fhmiVft0UZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040076, "uuid": "14b7ae6d-49bb-4279-b30b-6a80a25a6060", "value": 9023344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040076, "uuid": "7151a0bc-b66b-4899-b325-de06513ac319", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040076, "uuid": "c6ce45b9-4256-42be-8607-743d6fe3cf11", "value": "918b846b21167686b9d121e182c9dfec18e66b53fd1c33af1cdd1d0907e5fb12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e483bd-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775057702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057702, "uuid": "db748121-5b2f-4eaf-befb-1d6ca3ba6e9a", "comment": "Malware payload (VIPKeylogger)", "value": "40f6a301c58aedd27023aaa8732add03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057702, "uuid": "3146a639-4154-45b5-be6c-3fb0f060b2cd", "comment": "Malware payload (VIPKeylogger)", "value": "927c6d68f6413e437e4a919b2007f6a2ade32be71f80467856ce19a0325b63eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057702, "uuid": "417d41a4-57cf-413a-a36d-6418e27284fe", "comment": "Malware payload (VIPKeylogger)", "value": "6b6a187d38a519a473192b2f74afd1c5f1497783", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057702, "uuid": "fb07dd96-bd83-4977-93f6-005a158f62d2", "comment": "Malware payload (VIPKeylogger)", "value": "8ed3902b33a1919c99716326308e18035f55dead5e0df6ce78bdd1007835a8f972973f15f79b463a5dca4324033b4b59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057702, "uuid": "2bff281d-8f23-49f2-9c21-be39e8fbd811", "value": "T15AE36C60DA24027A0F876B9CFCA50661CABDD319463744B0F5DE870D520A9ECE3BD76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057702, "uuid": "28a8e059-633f-4cf9-902a-a6e231bca0d4", "value": "3072:dkYIAX2PMYp39rxrCNuz+T2XGy74FYk709SKXbJhggnPz:dLIAX2PMM/yT2Wyvk70fLjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057702, "uuid": "e6d47aa2-04ff-43ef-89d4-738d9387a45b", "value": 144825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057702, "uuid": "0a120ab9-43b4-4b53-9928-d30f6f1aedc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057702, "uuid": "8c7af70e-324e-4f7e-b5ba-efee73b9a697", "value": "factura n\u00ba 41.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64d9521-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775022666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022666, "uuid": "f6969a1f-d5c1-4faf-b067-7306207132e8", "comment": "Malware payload", "value": "cdd9932e575883489a546a455d9e06b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022666, "uuid": "7d36c022-c0f7-43d0-bc2f-57959f0c76e5", "comment": "Malware payload", "value": "92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022666, "uuid": "1ed3af62-7e89-4650-b495-dbf00720fb47", "comment": "Malware payload", "value": "14f37f31a9bffb48a78412b7f926b824222356bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022666, "uuid": "4d66758b-b008-48fe-b9d9-07a957f7d469", "comment": "Malware payload", "value": "e40f2e68436d2c2889da7991d85076a2cc519e6847271b2c8cebbea9496cb88bd30cab82413479cb96f3a7b5671c80cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022666, "uuid": "9914cfb6-334d-4283-b56e-b26fd37da2a9", "value": "T17DE026409812E873910E0DA4C94DB26CAC9A6CCBA0029E0DE140FEF51C8FA0033ADFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022666, "uuid": "57a523f7-caf4-42c6-a52c-86568999b331", "value": "6:hoCeceeCgj+MIlR7DTFZTFWubxPEWDTrFMBeTP5pUnB0WgymDGp0DFz:McefS+F7DxZ4ux8WDXFMwnWd+GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022666, "uuid": "62cee535-9927-4162-bc92-abf5ebb6354f", "value": 344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022666, "uuid": "a05e7df4-2f98-4454-8a2a-5a4c29d68e37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022666, "uuid": "362f37fd-e216-4057-9270-af04762bf419", "value": "updater", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f96f4f-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775063820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063820, "uuid": "4b47de7f-7f07-4a01-b3b8-fe66b6db7c19", "comment": "Malware payload (Mirai)", "value": "89356e16c7c276ce79503ce65546171a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063820, "uuid": "ee85afeb-1088-414f-bc6a-7b89d740f6ed", "comment": "Malware payload (Mirai)", "value": "92c5a73b12b763e644c6811c064f5719505a8923dab8861a2deff5c8a1f3c076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063820, "uuid": "f0401b83-2693-4bc9-8654-ea5d7155de55", "comment": "Malware payload (Mirai)", "value": "07d26bc708090b28915937fe179c96f838fc0178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063820, "uuid": "3b27822b-aca8-4aa7-a479-af4126fcd378", "comment": "Malware payload (Mirai)", "value": "f67d2dbf5aaa431a5a66b504bba56b9df64a4a6d734de32a72ecb68bb9dfaea9162e54d5e52bec2229604d7b4c34242e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063820, "uuid": "bdb0d1d8-9293-4fda-b24e-118cceffc745", "value": "T12DD308C7F900D9F6F80AE3374853080AB230BBA549925A377257357FED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063820, "uuid": "d8e2774b-d930-4dd4-8897-96177e35737b", "value": "3072:98iDZk+ook7ybLutEz2WXpiidGBb0xO6V1jbiALL5+b8N5:e7ybyt22WZi9wxOgLVP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063820, "uuid": "a27d26e4-aec9-4a8d-a8d6-a144f4ffc52a", "value": 140128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063820, "uuid": "7652a504-6407-46bf-b110-ca1d575a8c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063820, "uuid": "e62ef707-4c38-4e7c-b1af-e6eef0e6cb1f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896e4831-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057782, "uuid": "06fd2671-484a-45b0-92d8-761f298997dc", "comment": "Malware payload", "value": "9d8f1ef35d002efaecc2b52eb9fb5053", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057782, "uuid": "aac180c5-c6ad-4587-84a4-2f2dbb5a3d2f", "comment": "Malware payload", "value": "937dc703ff85e08f3cb6150015e9ab68e489c439a44eaf133f998b3c70175643", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057782, "uuid": "2dcf8c8f-e79e-4aa7-bce2-67bbc451d7b3", "comment": "Malware payload", "value": "24a3529888eb80a1d3d99acd4f2372fad4cf6e96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057782, "uuid": "c3c6b5c7-702c-4e46-9bc4-18659e122e8d", "comment": "Malware payload", "value": "1dea9763561a51f5182b6f67db61d154e8e6aad15821eb276e0a18793e12512a8bd04a91fb7f17ea4a42b205fcfd7609", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057782, "uuid": "48c9768a-e8fc-427c-a5ea-e5c5ea6cfa68", "value": "T1D864C012D7EC511AFAF31E80DA7E650244777FAB2A0EC4FE12244D8E197190899F27B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057782, "uuid": "23d20a18-2112-41dd-8f1a-61754c4c534e", "value": "6144:mYDC6cvixepldBn8W2g79NMfPD9nY6s3W4Cy/VV1pn59A+rRgfUS:HO6cNR8g7MDCHG4ttpnE4+US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057782, "uuid": "8c05224c-147e-4696-8deb-7d87f601b9ec", "value": 308100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057782, "uuid": "8f79945e-389d-4f23-9d37-4626cb1a3534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057782, "uuid": "8dcedad9-20fe-4886-8c2a-7e90912eb748", "value": "C\u00c9DULA DE IDENTIFICACI\u00d3N FISCAL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e404abf5-2df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775065236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065236, "uuid": "39783279-27ee-46b0-9254-fa13f315144b", "comment": "Malware payload", "value": "c8ccace07a6bb8bd03f660a27fd50bd1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065236, "uuid": "7ddc8e38-c183-421f-94c4-e464cf8fd757", "comment": "Malware payload", "value": "941f412065f843aefb80f567b67aff4fc368c19b723fb0769d845e87c9d06f9b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065236, "uuid": "377eb41c-21f1-4f48-8285-2ddf07612115", "comment": "Malware payload", "value": "f0305afe287680598828ed1eb6dc86f83965fb21", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775065236, "uuid": "02c1579b-106d-438d-ad2e-3368965fa906", "comment": "Malware payload", "value": "71610e2e97be2218686e3953257d5e15624ee8dba9a9a52cce7c8c12651138daca3aa5ab6c4c6aeace425d62c550d244", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065236, "uuid": "08700272-c3be-4f7c-b806-63752a4f94fc", "value": "T104B5339D37E9C130F1250974212971F599FAEE6D6B0993C7BE5438027FB068A633A4E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065236, "uuid": "ac75bde6-03d8-45e3-afb8-b8afef5f3f2e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065236, "uuid": "3e160068-ce6d-4eab-8297-4273b5cb40b5", "value": "49152:TgwRxnEf/bCn3z3xD8odINq9YCyM4/w/AB12EAt+c5nKbSdg7f3fs:TgwRxErCnjBQFNq9QF/mABoSAQSdifPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775065236, "uuid": "66e80555-e419-43ef-8c31-0e60effbbbe9", "value": 2341633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775065236, "uuid": "95794dbd-e3ff-48b2-b149-a28a0a7b828d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775065236, "uuid": "47ec64c2-90b5-4ef2-8990-c2e49e4ea52d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915c5c0d-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775038039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038039, "uuid": "43135a43-e807-4e0f-92c3-b1edf032bd12", "comment": "Malware payload (Mirai)", "value": "ba51b93f354fccc7f3a227b62dcec3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038039, "uuid": "2b963ad2-3a20-463c-b351-4e03fbe230d7", "comment": "Malware payload (Mirai)", "value": "94742075a3cbbff5f99b9b61b733ee861d4829c7d003d3c703aca5e39a66c8ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038039, "uuid": "55d0769d-a3dc-4be0-b8de-0e82b58acb27", "comment": "Malware payload (Mirai)", "value": "eb3fb441e65301e8b708a0a5d6721a46bdf7a162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038039, "uuid": "ef5ca2eb-4f41-4349-a367-20da3ee70f05", "comment": "Malware payload (Mirai)", "value": "3f448e8bd1b47846e7b7122f00c4f259f2c659ec3d2504cef58c78170762a538b0fc445304b844352985369b3622b33e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038039, "uuid": "a81b668b-5459-4228-9a20-e71286c1943b", "value": "T128E49D98FE4E3D42D2C7E33DDF8597A1212BB5E4D32382B27981025DE4DAEEDC6A1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038039, "uuid": "b2e018cf-a47c-449f-8525-5dc47c9b1272", "value": "12288:bFhJTGTHEt243J2s71DLj622oMOAdcIs5W1LFV:brJyd4171DLGBoUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038039, "uuid": "d2937bb3-ca2b-4818-8d50-fac319a5d46b", "value": 719264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038039, "uuid": "fbc5005d-e7a6-4052-9d31-568acd2efd00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038039, "uuid": "84288e4a-1ba6-485d-82f1-03090b7a11c0", "value": "kurayami.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e617fcf-2e08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775074997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074997, "uuid": "d461315d-eca3-4952-8e5a-71fe5115b65a", "comment": "Malware payload", "value": "59914991ec9fbd3117bcf1ad493fe37e", "object_relation": "md5", "Tag": [ { "name": "193-24-123-23", "colour": "#854136", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074997, "uuid": "2b295040-a76f-4bf8-a987-07459879d164", "comment": "Malware payload", "value": "94fc8f2c42dba35799a2d4dff80ffe2f9bead57ae9ae9f2bbdd897b4d381265c", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-23", "colour": "#854136", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074997, "uuid": "7119f480-b276-495b-9b6f-d993feb123a3", "comment": "Malware payload", "value": "c484bab29c04a6b5a340197aa1f811b6f327ecac", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-23", "colour": "#854136", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074997, "uuid": "7db18cfa-2291-441c-ab33-10d11960f756", "comment": "Malware payload", "value": "79f657f17efb5facb8b25f1567797ccf7fb352f3cb7ae57a447f7eaf9376c69e5c355b1b4100a18bdda3c7191b4ae9fa", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-23", "colour": "#854136", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074997, "uuid": "acb2b157-0c68-4c25-a1fe-c5bd96f4ac12", "value": "T19D7601AF6B1030B8C8155AF897B0AE01A7EC6C91BD9049EDE14EF717DDB4943EE89074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074997, "uuid": "9d3abc2b-6ae6-4307-b382-1391abbd509a", "value": "98304:84T08lEyQRBqSVVdWuDIIpwtXP7HAh9xj5aCNHfSQiNoQ01nD3Nz/:q9y0qnEICwlDH6xjbKQbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775074997, "uuid": "8db0cca1-8bf2-4ea1-ba8a-70c34f1c13d3", "value": 7247088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775074997, "uuid": "13b805d1-1ab3-461d-a025-ddb3ad12dddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074997, "uuid": "68375247-f75d-4b32-8bfd-f9f19d092d9d", "value": "Komodo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f738cb83-2d96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026184, "uuid": "a1cd635d-3d13-4cfc-b5d9-b711cbe91034", "comment": "Malware payload", "value": "726286d0dd5d3e7b445f519f8affd8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026184, "uuid": "ef91c674-dfe1-4eb5-8eb3-196e5ff624e6", "comment": "Malware payload", "value": "95f7157613d19ae78def180364b199b167f7966791f5b7471f3b3ee06f237543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026184, "uuid": "4bf927bb-c37f-44bd-ab98-4cf2aeffb048", "comment": "Malware payload", "value": "9b1b5fe1bc061c9a4d7381280046bd655f630b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026184, "uuid": "eca01ca5-690a-4b53-bb21-c7f260e58e0e", "comment": "Malware payload", "value": "85cfc6fa86beb7464c070521870b5d936eb84477c90f26f8ed6c97485c8decf7a2b691720f655a2b0709073d631e820e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026184, "uuid": "18bf911b-e372-4e74-aa0c-d5dda91aae5d", "value": "T115A68E03EC9515E9C1EAA23189B69253BA717C485B3263D72FA0F7382F73BD06A75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026184, "uuid": "d5f13853-1795-42b9-a954-72f42dcdd304", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026184, "uuid": "abecd14c-12dc-4896-842c-30af826bf758", "value": "98304:CyC/uMw7Uhvzp9Dqg+Ww4PUEzPCFGYPjiesHwCuFqol17AVn71Xgqw:CyWVw7gvznDqyz4PjZsQNqoP7AJtgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026184, "uuid": "acee4183-adf0-4fde-b5aa-d6a9eec97abc", "value": 9598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026184, "uuid": "33d85a66-a0c4-4392-a23a-a727a0562a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026184, "uuid": "8b3d141a-7c9d-4210-811f-0889e86b6dcc", "value": "osamabinladenclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e62721-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775050555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050555, "uuid": "d2d62ba0-ea28-481a-bdbf-348bf4e628e2", "comment": "Malware payload", "value": "41111f90b465903c7bd2c3d9c99efef6", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050555, "uuid": "50cd0701-c92b-4636-bf55-339a9bf3ac6c", "comment": "Malware payload", "value": "96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050555, "uuid": "660ae0ec-c542-43f3-8236-b7d1d4353af9", "comment": "Malware payload", "value": "952ad3021b50a50b057a8d0b7f54ec33433e8fec", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050555, "uuid": "774267e9-5f14-464d-b931-b90187213719", "comment": "Malware payload", "value": "3c8d71ae12492516757d8f90095f250f694b574e15bcc8e784576cfb98eea4db77b876efd66daabeeb131fae235d0e4f", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050555, "uuid": "ee1e9e39-72f4-42a9-8289-0d2d11928cc9", "value": "T1EFF04901FA4FBC6505B6773542564848FB2A065B0440119ABE4F943FDF3D245C76E584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050555, "uuid": "519fc8a4-1d1c-489c-9018-379d76f645df", "value": "12:TMGzUofGoySkVwlkwa86ljV7oPaDFOSG2JxqbLSas+hMxrtMxjqn:3zUBo9KX86Rh5YeIHMTMIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050555, "uuid": "ececb5b6-e52e-4067-827a-6bf6aac7ba8c", "value": 651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050555, "uuid": "a78e9cbc-edf3-4179-b4a3-fb9b0a85e186", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050555, "uuid": "59ab6bc0-5cf4-4c46-bdd1-218a3f51924c", "value": "AdobeClientSetupV17.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cead6d58-2dda-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1775055321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055321, "uuid": "51f69f57-97a0-4b87-8d08-f3ba68018813", "comment": "Malware payload (DeerStealer)", "value": "f153fff962409398b0edb27961e54f6b", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055321, "uuid": "2a5e7db0-e6c4-4e08-848b-6c2df3d936d6", "comment": "Malware payload (DeerStealer)", "value": "97b9baa6e486c6515f4eff4e625dcec79907d785255c40c070a53cb98f13fa35", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055321, "uuid": "df42935f-debf-4c23-8123-98ec8938d4d8", "comment": "Malware payload (DeerStealer)", "value": "db49fd1e73fb8930d07ede03d5a16d5bf70f322a", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055321, "uuid": "57ee93d2-a2ac-424c-964c-49bbaed56e87", "comment": "Malware payload (DeerStealer)", "value": "30d5f24ffc015b80b0a990ff84c8299ec6094fa5e979a87dfcf5d9d2876452867a4eb9024f37d14cf613e47b2f1f0f9d", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055321, "uuid": "83838a10-55fb-4add-877b-837a5b3b33ad", "value": "T185171213B680903EE56A02718C6FAE6495A97D738A314257F790FF0D2DF0592B623F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055321, "uuid": "e1101193-d62f-417e-a62b-225368c0c4bd", "value": "2ac0df3cb49d714c81e70b5b92c304f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055321, "uuid": "6d9f1b3c-ace0-4f44-98c9-7429af98a3e4", "value": "393216:J3H/21PC9tfsquGSII7Crg9Kd8SLriAjEb9zbiuQTJDPm:hfckfQLmk9KiSEtiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775055321, "uuid": "b9b5efbb-624f-4692-8c9b-dacd60ff4405", "value": 18938049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775055321, "uuid": "b0958b55-7a1a-4617-a63f-523ebab038d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055321, "uuid": "ec47d346-723e-4ace-a340-d13b7910ff65", "value": "Cracked Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d467f702-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022689, "uuid": "955c755a-b97c-468a-8ed8-dc0ef40ee072", "comment": "Malware payload (Mirai)", "value": "80986304535ae8e97b496017e316356e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022689, "uuid": "0049b73f-8fa3-4c76-a3f2-67ad7a09f022", "comment": "Malware payload (Mirai)", "value": "985cb51febf70a96b96a977e2fb01d54d5b9f38a5930581e4e0fbdd1b1a35dd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022689, "uuid": "8a912ec5-67a9-445b-8c55-20958729d281", "comment": "Malware payload (Mirai)", "value": "fc9be425d0931c18f532a7824193959778048bdc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022689, "uuid": "6adc4377-0be6-4e3b-bd17-11f04a7e9608", "comment": "Malware payload (Mirai)", "value": "36ee45f3f894b7b9b5d99ac0914adc8b108ed874feabaec21ffe0d06c28a8bd7cc648e0392ae8a4697f756c0c561904c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022689, "uuid": "09749cb5-c01e-4f87-a713-0cb5e0b89031", "value": "T119237D35E01E8ED4C442457868A88F761F13F1C893635EB71AE682B5684797CFA09FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022689, "uuid": "7f023f6d-1a2f-482e-a474-7c54c0ef2b20", "value": "768:paEqerm5KqtleXtELrTsU0/fWatmemo9svpDYCUIJboyOK01uHwE:pazzK++e70/fzcNYWJ8yOHuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022689, "uuid": "7164e4cb-960b-4acc-a975-06a983e81041", "value": 46524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022689, "uuid": "e829d4e6-72f9-4d91-8f7d-be55ed30dd02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022689, "uuid": "c56d960b-e707-4c2f-b426-0c77066b4515", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015f87d-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037983, "uuid": "e41d9fb0-ba93-424f-b123-a0ea26d0e1f3", "comment": "Malware payload (Mirai)", "value": "d37ec7246720618ddfc58668422c30b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037983, "uuid": "b6c4c74e-eb89-43ef-ad1e-2b37f3b21309", "comment": "Malware payload (Mirai)", "value": "989a4868eb390b4a1d97cf77bd810ca843ea7fdae3eef115a1ffcade96c5033f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037983, "uuid": "cbc4befb-a5ff-4712-9a7b-620d4bce2bf9", "comment": "Malware payload (Mirai)", "value": "7d80b2b22fef76482ee5378204adba972a377599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037983, "uuid": "cb79eda5-3f64-4d82-9435-60c1d9efa068", "comment": "Malware payload (Mirai)", "value": "46a2c24a7219047da4076d5e586c3b3ac324006303a0530bb029aa1599bd4d6c748c7e7c4bb44873d7db81eae4574278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037983, "uuid": "b21f458e-ef9f-40a1-aef7-c72aa35fbb5e", "value": "T1E634235847F4D367C53428BD88BC80FC1A014E2973FE60A7AE22E56FD9857202D59BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037983, "uuid": "4331244a-3886-4089-8b8d-5196c849e26d", "value": "6144:UJ3dOqy+6QLf0bru4b1wl0P7LzbyLtjRJDIGm/e:U1xy+6QLfY92WP7LzGLt1JDIP/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037983, "uuid": "97257bbe-4555-4571-b43d-28e06ac94609", "value": 252792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037983, "uuid": "50846dce-6689-4135-8645-9def9859335f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037983, "uuid": "2a6079e6-8595-4ac5-ba53-369989103fff", "value": "kurayami.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e3e0e1-2db4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775039071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039071, "uuid": "c7069197-d599-46e0-9e94-ef6cb8914d4e", "comment": "Malware payload (Mirai)", "value": "c81e88d2f2794afead3edb2b6b23c1e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039071, "uuid": "2413d88c-695e-4e3e-bb35-95d741aee541", "comment": "Malware payload (Mirai)", "value": "9984df2dabb8112ccd999523e62ca9c671ed1a8e3649eb0928768919735d5200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039071, "uuid": "3e4536ad-ca85-4360-8a53-111afa391eaf", "comment": "Malware payload (Mirai)", "value": "98e0b49b807f0fac602483c41bf1e3fabae1b1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039071, "uuid": "67c89ecf-eba1-4e05-93f4-a36b3dd05e0e", "comment": "Malware payload (Mirai)", "value": "684c2d9425d1ecd69481fa6442d3c343ef1e13841cebe45c1d2f1f4faf9baf52922def5a3f539f0f8ec4dc51a327c408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039071, "uuid": "c6c3b3f4-b7c7-43d8-8ee5-8e20e3623521", "value": "T198042906B5CCC0FDC89AD1344BAFB536D971BC5D023CB25B27C5AE222E4FEA05A2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039071, "uuid": "21da9dcd-eabc-4ae1-837d-fd538e56e6b9", "value": "3072:lZBh9eWdVFe5uF9Oe1BKTssZ6re6IPjN+gUmcxO+/cztjRlfhNV:lZBh9eWHFeXC6v6q+xV/E5NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039071, "uuid": "c93379ea-3ba4-42b4-a09a-7ea9f597363d", "value": 189992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039071, "uuid": "18b38240-ccc1-4bc0-a761-97ccca1b84fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039071, "uuid": "752786fd-af60-4c88-8974-b15a18c3c5ec", "value": "kurayami.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d90c6-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066714, "uuid": "79f4f7f7-e35b-40ee-af67-f6fe1946982c", "comment": "Malware payload", "value": "3e40440b46be1fe8fed1559f028e3fa7", "object_relation": "md5", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066714, "uuid": "cb638af6-3851-4cdd-9825-9978837f01b2", "comment": "Malware payload", "value": "9989f65ce5725ae68ab55d3f8c6096a49595dfeb824b00aae931815032651a27", "object_relation": "sha256", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066714, "uuid": "4cb8c400-db88-4c09-a966-11bd0cd0cfa4", "comment": "Malware payload", "value": "ae88141a6e16427205627e938a34a96fa74a7709", "object_relation": "sha1", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066714, "uuid": "c8df23ee-4424-4ed4-824e-dbf3ea8d5fce", "comment": "Malware payload", "value": "4d07b20aab94d041e7f491608057364a882c5ceddf5a573ec9321a78bf57976973f10e50e96c7e42f8aedef55c16a425", "object_relation": "sha3-384", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066714, "uuid": "f38cdd17-30f6-4d10-b991-93eb92d8312f", "value": "T18B21E117FFD9D833C376EC7D1109A10F16A96509CB1ED350872900AC6A7336AABEA1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066714, "uuid": "d06957de-553d-41f4-91a1-3bb36f6a3d0a", "value": "24:GOsw2RfRtS98QOiTy9hUzdwJiPXw3Rs0srMiQsO:G3w2RZY/OUz6JC0mtjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066714, "uuid": "34a72c74-996e-4f24-8b5c-4e8d1aeb0ee8", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066714, "uuid": "00e4b335-f9af-49bf-82d7-cc524434e160", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066714, "uuid": "7accf771-8561-4bf7-acba-12c82f162b89", "value": "9989f65ce5725ae68ab55d3f8c6096a49595dfeb824b00aae931815032651a27.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50092a73-2d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775015595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015595, "uuid": "9712666d-cfa0-4e4f-8a77-7e75da712985", "comment": "Malware payload (Joker)", "value": "a6b78f237562c8190f9c3cc14c026b30", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015595, "uuid": "cea3f693-5c72-4796-873b-df617993815a", "comment": "Malware payload (Joker)", "value": "99a0ac7dfc36d8a91bea8d81fb29371b6b4dc191d19b0517f0111216360dff0a", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015595, "uuid": "1f98a47f-39d0-493a-9d29-ba519c80ad84", "comment": "Malware payload (Joker)", "value": "95aebd9e88af5e7750f48f41ea3d227c7ecefc62", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775015595, "uuid": "a9fecfae-a927-4ee1-ba0a-47a6dfb037c3", "comment": "Malware payload (Joker)", "value": "a09c021550033f61f4d3ab684fcdb346dd31cb2b35a6604cb5cc8c09fbd769a1a9444f5913fe0eb4ff945f698752c5ab", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015595, "uuid": "d41390d5-82cf-42d5-99d8-3dbb6c8864e6", "value": "T172A62357F30D982FC9D6B13D992502A1222BBC6C1661D3DB1D11B229ADB3ACC9F19FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015595, "uuid": "eddc46ae-98e0-4a33-9c0a-be7ecdfa5f1b", "value": "196608:VpJ0r/ypARz//+4oBsU+Z+PmO2OvS9VcK6aGhe0rx1eX7GT9+:VpSr6+JWlBsU+Z8mO3vmVkJIXak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775015595, "uuid": "0f015ce0-084f-40cf-8a3b-c7167c4c5482", "value": 9903730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775015595, "uuid": "fb7e553d-31c9-43c7-8a0c-c0b10540694b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775015595, "uuid": "6f55d74d-f792-4533-83fb-bcfcc0fe8697", "value": "com.filedelete.phonecleaner_1.2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff5bb86-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775057552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057552, "uuid": "185b6b5e-14d9-41e5-843b-278a10e17644", "comment": "Malware payload (VIPKeylogger)", "value": "61d148a1f6f0ba770ebc6d490663112a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057552, "uuid": "8319ce47-26ba-4925-9ad9-c9f9c72ce6a7", "comment": "Malware payload (VIPKeylogger)", "value": "99f8a75fb301a60588d16fc659fda59f2c48cddfd2d3a730cf9a97d98b1b6023", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057552, "uuid": "d99eeee8-a0a0-48e5-a84c-add25aaa689b", "comment": "Malware payload (VIPKeylogger)", "value": "6dbd40a933e2505c6dcba1a4c75c2297e07ee2eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057552, "uuid": "59a156af-544f-4899-a7a7-dbf33bdecf7c", "comment": "Malware payload (VIPKeylogger)", "value": "e9afbeb8c78b422d4d7930bbe8d44f6b74f6d270a2196cb9858cdca52f54e5fc577e65a136d342aa647e9f7d3c51a7bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057552, "uuid": "14fd8d4b-b8d9-4745-9b25-d15260dfe410", "value": "T18072B68D76CAB4AC1363342B1E2BA096A5ED9C80784CE548FBD4F5EDFC703189567938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057552, "uuid": "1646a93b-e46e-4c44-ad3c-437d3f5ae02c", "value": "384:grCdYzjIaLDj+ige7tlpnxVhRnbf9VqKa4pItjzizm:bdYzvHAolpx9f9VqKfCmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057552, "uuid": "481717bd-f78f-4777-b7b7-3b403e7770f0", "value": 17120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057552, "uuid": "e19b1ca3-96b1-461f-8db1-073b39aa2823", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057552, "uuid": "4a14ed01-75c8-4b11-a970-2262a00730df", "value": "Technical Specifications Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc96f3c-2dab-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775034996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034996, "uuid": "e3cd8ad9-b287-475f-903c-0b831cee7ff3", "comment": "Malware payload (LummaStealer)", "value": "7ed767a109047c0d100bad0a5d98f2a8", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034996, "uuid": "6129f3bc-4728-49c1-9c32-adc17cb2349f", "comment": "Malware payload (LummaStealer)", "value": "9a75bc0cbd4a2e57bf342a05c0f694a0986a928b5e01237cc008e1c8257516b4", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034996, "uuid": "2f82f45d-d5c6-4224-9041-de1321206cba", "comment": "Malware payload (LummaStealer)", "value": "c021eb24fba4dc862e3823a0c81122924652bf64", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034996, "uuid": "37b99e0f-20b2-44a6-a877-abb9349737f3", "comment": "Malware payload (LummaStealer)", "value": "52f96ebded7c38987c3ec8513b00d5cce5cf7302f0dd3613ba244f15a3301b49fd1a348186d801bee70b6a73663bed32", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034996, "uuid": "34d9613b-35ee-4166-b07d-fe5abac27ad6", "value": "T10F755D00FDE785F6E41A173285B772EB23269C098F32B683EA557B7DFA721D11825312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034996, "uuid": "b83a9977-8f45-4fbe-a39b-ec905745fe0f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034996, "uuid": "621826e6-ef6c-4ce7-b823-4b074d5a8859", "value": "24576:aSGJfepQcmQvLo9LPcfxdBI3pZvIOOIajmDzPjzA/B72kutL4cVCp+0aSBM1xeoF:aVc4gZDqkQJ8EC7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775034996, "uuid": "3f597a84-1721-4cb9-aa28-5439e109282e", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775034996, "uuid": "c4c00792-477e-4a35-a2a1-bfd2ada4d778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034996, "uuid": "80c99497-4224-40c7-8e2b-dd0275996402", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91957928-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775063809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063809, "uuid": "7edafc8a-b57d-4b7d-8e41-9af0dd5bd139", "comment": "Malware payload (Mirai)", "value": "f497bf8388f513e21caac04c28685cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063809, "uuid": "c7a43950-d28a-4f98-9f2f-3f84742fc50f", "comment": "Malware payload (Mirai)", "value": "9a9bd0c42b15fb395d59d904d5b44d9c2e43fdb4862c762f78dd2bcde8d72a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063809, "uuid": "e177e5a4-aa40-4d3b-b25c-45fc70acb111", "comment": "Malware payload (Mirai)", "value": "8e03f270f51ad6b5c7916735a93b8d8bd7aeffd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063809, "uuid": "3de7d16b-d07a-4147-a772-3264773484f0", "comment": "Malware payload (Mirai)", "value": "24083591e08c3bf2109be1d1b92400bb1f07d6c1410f04abc75f979a69994d0505bd82b6f505674059d0bb9781c3cd22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063809, "uuid": "01295378-eb5b-49bc-b972-74234d01f3c4", "value": "T11D333B4CF783E0F0ED4B0571115BF77E96349E025124DE7EEB98BE62AE32B12A117618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063809, "uuid": "a3c598b0-54ee-4156-954e-bacd9d8361d2", "value": "768:IwJixk1eCZmUJ2SrpFlPjlWwhTlFtBZ6zDYvBeVwXU2X31ANA0BCRhOqD198+tEr:IwrtHrp9TwLwXUY31ANA0B0BCTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063809, "uuid": "c3ecf5dc-f543-485f-8ac0-26ffbd1bec65", "value": 50508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063809, "uuid": "b3001549-c004-44f4-aea2-8984cdc5b70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063809, "uuid": "b17bf25c-fbb3-4aaa-9515-96154bdd29bd", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72696808-2db2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037987, "uuid": "986824c8-b540-41c9-8218-9c894377d0d5", "comment": "Malware payload (Mirai)", "value": "60785244ea5e224032377fe3ee56f0c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037987, "uuid": "00386693-c8cd-4b5b-82ca-3fbd5b02bdbb", "comment": "Malware payload (Mirai)", "value": "9ab5896db88a6279a4c0e3060e0061d8357d2077ebb1115f9449d1eb3db40b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037987, "uuid": "e833d7b4-17b2-4ac5-9fbb-0655ec1f1614", "comment": "Malware payload (Mirai)", "value": "1855ddd9b50b7ec97aa56518caa793329cf5cd3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037987, "uuid": "283ec89f-1f27-41ef-a552-67d8213e30aa", "comment": "Malware payload (Mirai)", "value": "a5a0e12b0daa4c67ba0432913eac0171475516aca98c21519cdcd0452725e8d82254b1ca0809e02c4a947737a623e2cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037987, "uuid": "7157e842-d9ef-466f-bf0f-7bf77ed92947", "value": "T166430272DCB5C808B16646FB4536FBD1D1C2907E5AB808BB6B5038E119F95B8B621BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037987, "uuid": "eb3a54a4-d1e2-4888-b71b-be9abc25e30e", "value": "1536:6UaADD5K5ZZwFQesZBE+a3MrucFjZSPOvdoCQd4oZGclNUnouy8Hy0:jtlK5Zi/sFCLQjZSPOvdoCQq6Nkout/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037987, "uuid": "64bb0d12-5bc2-4647-8043-f7191992c07e", "value": 59972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037987, "uuid": "59cbeaec-8ca3-4ecc-bb90-a5fb662ae044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037987, "uuid": "f549a39d-a728-437e-8e1b-cce494054a85", "value": "kurayami.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569d2d0c-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1775053831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053831, "uuid": "4f3b3b82-c2e2-42f7-9436-94aec3dc61d4", "comment": "Malware payload (STRRAT)", "value": "34a837b312c350af3ebf4b72454fcb69", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053831, "uuid": "32120b71-5168-4af9-81d8-0053a57c974a", "comment": "Malware payload (STRRAT)", "value": "9b160425fb2a2d6cd125509bface7b506430a35efa2dd3443dffe464f4a46b23", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053831, "uuid": "f95e3580-5790-46ca-8934-cd17c972a50e", "comment": "Malware payload (STRRAT)", "value": "74dc44ea1bd418faf36740c7f68ac00c08e27f8b", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053831, "uuid": "147e99b9-57fd-4a0d-9c59-f05f3512640a", "comment": "Malware payload (STRRAT)", "value": "2046fe024119d791df00a9f83c75f1adcc74e08c86edbb8dfedd612c35f0d20c31cb411720ef86129f7b54a2a00a042f", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053831, "uuid": "7d580f3d-e3e5-4b73-a26b-9e2e8109a5bc", "value": "T15A03F227355A25718ABD26F98C03F961F6EA212F4799F8D8339234784F314A4AD7850A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053831, "uuid": "2aa8756f-a625-4e3e-8e7e-ce535eaec496", "value": "768:pC6hBK/HyrIax6ME/o+wj4PrB7hl9IKL0g9WHoMbhjxuyfTFlYsntC:oyBqStxx63wQrphl9IK/WHokh0cTFlbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053831, "uuid": "22978344-3003-4cce-8d3e-9aab768721d6", "value": 40622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053831, "uuid": "8adfddde-a57f-4e8b-9ffd-871f77ab954d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053831, "uuid": "7eadd224-086f-439c-be06-87f88c8ade17", "value": "Shipping Bill2008581 dated01042026.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254f8447-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039146, "uuid": "ee6cc0a4-7c83-45a9-bd88-7529e15dfa2e", "comment": "Malware payload", "value": "433fc2458c73355151e07bbeee36658d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039146, "uuid": "5781650f-f9c6-43f9-8180-58d438af6671", "comment": "Malware payload", "value": "9ba23c9e2fbc61850f8d08179560b5c810be4b780dee911ebbadc485d0991445", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039146, "uuid": "d0f129fd-6be2-4f85-b4f9-1a0cb77c9f31", "comment": "Malware payload", "value": "b30b4cf6a3658fe459794561777f275fa75346fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039146, "uuid": "15b85e52-cb54-4e96-af13-4e8b9c82c5bd", "comment": "Malware payload", "value": "8b6f124726c1176089bc28a8814cb07ce7bc2339a15e5c9711554e796f874c7292d6ff7f610c5f30d63a54f0e2ba54be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039146, "uuid": "050a1327-91f0-4d0c-a633-14253ca16ccb", "value": "T11B43C8077961273FE65DC70AE18409BC975AC35D422BF1BDC2DDD12F180DE8EA632AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039146, "uuid": "035cf872-f36d-448c-bc0a-38304f8a22a9", "value": "384:/8KO1MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGvc3ZWthXLpfqz+DfTTb3oLnah:COOq58H8XtO8fpE3ZWHLBqPiRzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039146, "uuid": "b2d94edb-f001-4739-b662-96078d85c553", "value": 57627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039146, "uuid": "2ca53ba3-2fca-43ec-8335-d1ed7ad3560d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039146, "uuid": "fd5ffb5c-75de-42e0-a011-58795ce6ad79", "value": "9ba23c9e2fbc61850f8d08179560b5c810be4b780dee911ebbadc485d0991445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fab512-2da6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775032949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775032949, "uuid": "18fbe1d7-e548-43af-9a64-a0783d9ef0ff", "comment": "Malware payload (Mirai)", "value": "3d1546c8a96036b426df4ea07cb70cef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775032949, "uuid": "3c53a140-e108-4a57-882c-e391d6f2a6d1", "comment": "Malware payload (Mirai)", "value": "9ca881abd3c11368e381b8a9f6d32ef14e022058ce936922afb82164c17f3310", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775032949, "uuid": "da9daf3f-20fb-46f1-a1ec-103957e714ad", "comment": "Malware payload (Mirai)", "value": "01de119c65301788bd65c921f5788232a48dde54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775032949, "uuid": "65ae1852-268e-454d-9aeb-88c55e1865f2", "comment": "Malware payload (Mirai)", "value": "44ffa19af2a6e746589076ac0a13ef52150b96bbaa27f9335e03c02449dbab54a51065e6db85e2d2c76a2e8fbcde68ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775032949, "uuid": "486b23d0-d231-44cf-bcdd-9973407bbc15", "value": "T130C162821145CF33BE08ED1679A55D0830D06AF1D896FF0AD8FA5592FA5DEC8A902E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775032949, "uuid": "5f92edf4-52a8-43ab-a583-2a7c4716715c", "value": "96:rhEVud2FvoGKP2p+xFt3zGJE/c3Fo8r7liJOpKdJ:uVud2Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775032949, "uuid": "a0453e72-1c84-424f-85fd-1746e7143f46", "value": 5666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775032949, "uuid": "16e64965-3f2f-4dcc-9c95-ed6079621eaa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775032949, "uuid": "d1045fc1-485a-44c2-81a0-e45e3eecd50c", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa6f301-2dac-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775035593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035593, "uuid": "b7de152c-ba36-427d-a1a9-db5193ff905f", "comment": "Malware payload (ACRStealer)", "value": "a1f2b1692dc3c5a731aeeb083a02b654", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035593, "uuid": "811f6c99-7afb-412c-8516-38cef8a46da1", "comment": "Malware payload (ACRStealer)", "value": "9da0a2d5d86790d615e32d54870656a7917f515c1a44ca2849c2c3e704b0286b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035593, "uuid": "2c0978c3-6608-49d3-a481-da4e91ba1177", "comment": "Malware payload (ACRStealer)", "value": "d1677557edff7ae90c72e568bb69e21a7158f83d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035593, "uuid": "ee193fa3-c63e-4847-9798-72134c33f25d", "comment": "Malware payload (ACRStealer)", "value": "1e630f6b165d8292bd214dbb016a92807fe9e668e408382e8a4dd6f84fb3e9daa7d17d1a71a79c1ea7e5eab8e983dfef", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035593, "uuid": "d143adc1-bb5d-463c-8264-b615d4e968be", "value": "T1B076E75AAC500180E0649134662F932377BB3CA85F355BC72E95F7342EB7BD42AB1B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035593, "uuid": "0b155e4b-da97-4845-9892-9ad018306277", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035593, "uuid": "ed60a647-898f-4f05-b90a-c9e0a7684cc2", "value": "196608:cv7MK/tUTDo6Td+npJnW3s769ZK5NLKdEoWLtdZWe4oOoDlCd3erFGXedmL7qulD:cv7VUvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035593, "uuid": "61ca6163-e997-4774-aa39-00a67cce4824", "value": 7381504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035593, "uuid": "0b75649c-d69f-427b-b208-be59f9124417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035593, "uuid": "c14e8593-d593-4fc4-8cbe-6642476853cf", "value": "SecuriteInfo.com.Win64.MalwareX-gen.82112584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cd32c6-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053728, "uuid": "49533b3c-7e08-454a-80bf-0660babfb64d", "comment": "Malware payload (Mirai)", "value": "4bb1bca793036c69beb1b3540d5020d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053728, "uuid": "12523f69-00ac-43c3-9036-f350f165fced", "comment": "Malware payload (Mirai)", "value": "9da62e78eac612482a53ba8f941815f07398381e37824fd10b944ce3ecdeaf41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053728, "uuid": "05c1c0cf-73e1-41da-9a97-c5513a518acb", "comment": "Malware payload (Mirai)", "value": "39ff3392ca2ace0c1cb978973e55d6b207fa5451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053728, "uuid": "450de8bf-0b31-4f85-b18d-61d64fc95bbe", "comment": "Malware payload (Mirai)", "value": "575039f3f991787cba34ab79215f2b31f85541cf64899a18ed0a2ded46c61c05fc2eea75f5a86ef9e91b00ab8be6e0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053728, "uuid": "086d8960-a43d-4dd4-9d34-7056927d5e8a", "value": "T1E9C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053728, "uuid": "91bb3a35-45e4-4608-a5e9-ec2003b03325", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyFw:VoRNjmj1VGFVrRiyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053728, "uuid": "7dd0c0c4-1e6b-4a1d-aff4-a11aebe1a798", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053728, "uuid": "305042f2-518f-49ba-a76f-1bbde37deb17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053728, "uuid": "a61f85f2-6a26-4ff6-b329-a38f8565c51c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75ddaab-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775038532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038532, "uuid": "9a98eada-270f-47b1-bfe8-444ec27a473f", "comment": "Malware payload", "value": "93c8d8af121507dfef13b91e4f51594d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038532, "uuid": "25ab99b3-7cf9-42d5-ba62-4e0c504fc31b", "comment": "Malware payload", "value": "9de338f3919597401019e2e6a7747c09a803111c04672e3008de8bd6ecaa6ba3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038532, "uuid": "f95bd121-c870-4e65-93cc-21da4e824c64", "comment": "Malware payload", "value": "ee53de6d9c4f582019bc7cb1d63f822c3748c63f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038532, "uuid": "cb0e39ed-2a6a-4270-a01a-f45b9223271d", "comment": "Malware payload", "value": "8d63136d5670ea5ca87d60092f7f8b577284dc8f6ac1850d7248fdf9e79f9067f26633fe91fcb8a249bf1c03595fd697", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038532, "uuid": "5021094c-d7ed-4f05-9b3f-855d12a9acf8", "value": "T1C15733ED953B56A3CE17C07D73319A84CB49AE3A49CE54279B8EBFCA41B35E0309141B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038532, "uuid": "48c8abc6-b4cc-422a-af4d-bef1be564956", "value": "d0dd5fef52fd41e8fcf5d6d0eed3d3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038532, "uuid": "7ebe46f8-4d77-40a6-a611-76fe06c328fa", "value": "786432:sHGTLOe4iQMZjv7DpjLalX+/R6qdkbAs:smODwzZ/Gupip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038532, "uuid": "e2afc559-7bc7-44c8-a436-43b31acb787c", "value": 27059200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038532, "uuid": "b9886d9c-e38a-4ab6-88e0-c5817c8582ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038532, "uuid": "f7336a21-418d-4db6-a6e5-111ff9e8ceb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dad354-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "8a978e0a-60c9-4823-8128-3a7d7120a544", "comment": "Malware payload (XenoRAT)", "value": "b94455267d21a4f8b75fbc0abaf0354b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "5de9b411-a8f1-4b43-b324-b65f6c91292e", "comment": "Malware payload (XenoRAT)", "value": "9e2cf2cc2c04526324791235be04224bdf13442ba120045bebf9639b435b240f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "f4f1d911-05f3-4975-a057-92cb617d9cb3", "comment": "Malware payload (XenoRAT)", "value": "ec56034e179c25184760dd66157cf6018be29906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "275a40f5-33d3-4bf0-a2a4-5bd3d278bb2c", "comment": "Malware payload (XenoRAT)", "value": "6f3aca04e29620984c41b5ee25e4453f68d76225031f73e5122a383b97feaf675ac48c81b11272d45417f48ed778ef04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "f0e36eb1-f2ec-4b3a-8ec5-1780934d51f7", "value": "T12E23F84C57AC8927E6AF1ABD98324263C7B3F2669532E38F08CCD4E937933855905397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "e214edc1-ee59-4fda-893d-72da65167a4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "4eaa6a02-48b7-4b35-aa26-edc90320b854", "value": "768:hdhO/poiiUcjlJInNQH9Xqk5nWEZ5SbTDaFWI7CPW5w:fw+jjgnuH9XqcnW85SbTkWII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060774, "uuid": "76922521-a203-426f-bcab-e93cdc00f3a6", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060774, "uuid": "44833713-d5be-47bf-9855-413f52b28a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "fd0a9841-991d-470e-90e1-96b37cdd5194", "value": "PerformanceMode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd97491-2d93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775024775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024775, "uuid": "12dc6693-471d-4493-9bc3-f9e17f7fa113", "comment": "Malware payload", "value": "69ed64ede77238010838a4c0820cdec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024775, "uuid": "2ab0c600-a188-47c3-ab1a-35cf520412a8", "comment": "Malware payload", "value": "9ea7bae91dddb20ae6ed8fa101be074b7f75b1d249482ef15daca9e18946e154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024775, "uuid": "a5c67262-dc65-4646-86d7-c7d46a0534f1", "comment": "Malware payload", "value": "8756556013f7f21e742cff8d9628b2fd2f7c774c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024775, "uuid": "f847ab81-059c-4d05-a99f-ebb04b3a1701", "comment": "Malware payload", "value": "21bd05e129a37f7db0bd815121504306645926f5b97a1b47a9a714c20552b03cfdf52f3f77cfd64674424b440595cf20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024775, "uuid": "9975b522-0997-4e24-bde0-ca987b506dcc", "value": "T13CA68D03EC9559EDD1EAA231C9769252BA717C481B3263C72FA0F7382E77BD06A74710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024775, "uuid": "3df08ac1-bbd8-4263-9219-bab15027bc2b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024775, "uuid": "68c87779-dd12-42a8-8975-338420bb7908", "value": "98304:do+CcD544yvAUYG9+U+9EEHsPUDQJCtL+NurEhkkMGC:do+p5NyvUOlwQJ7NaEhwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775024775, "uuid": "17f46d5d-c654-4e1c-953e-2663463703de", "value": 9581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775024775, "uuid": "ac26d403-9ee3-4b37-bc44-eb7cd161120b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024775, "uuid": "905fec6c-07fd-4e01-99e2-2f87d0c0be24", "value": "osamabinladenclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a6025f-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Virut)", "timestamp": 1775039255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039255, "uuid": "51d412ac-116c-4190-b10f-8ff8b4921660", "comment": "Malware payload (Worm.Virut)", "value": "e26d904e5e4d75235a47e92375c928b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039255, "uuid": "a6e4bd9e-680f-43a4-a17a-7eeaec7d810d", "comment": "Malware payload (Worm.Virut)", "value": "9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039255, "uuid": "cd7bcd67-5a3a-47f6-89cf-8a8fdd50cc00", "comment": "Malware payload (Worm.Virut)", "value": "41fb758b60023a7c3ddfeca287347b969f535588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039255, "uuid": "ebd577f0-0c16-4449-b323-09b35c026c49", "comment": "Malware payload (Worm.Virut)", "value": "30f6c1dd9c93ea5668906f5e3ff463b008630f3c4509f91797fe3f7780d05e537f2ba9c2170fd7cade410ffdfffb7d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039255, "uuid": "4ac8d2e4-24c9-4140-ae60-67e99a5eaf7b", "value": "T1D454D3087F48E837F80E827AFF21CF568D6D54199D9840EE76B0BC8D18D99CA3D25939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039255, "uuid": "e9467f0b-90f6-494a-961a-b07a953ba4fa", "value": "1bc8a8ab15f37dfcacba988951c15280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039255, "uuid": "d3209591-a8da-49e9-9f93-7704fedead52", "value": "6144:9fnkgN3hEeHkfeQZwX5uHMKT9qrVUTiR0gzyTVeN57tmZ3qY:VxNXHMeXkHVC6tZevJmZaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039255, "uuid": "05ec3c00-ffdf-462b-ac2f-446e4f0fa73f", "value": 295316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039255, "uuid": "f7cfca71-59f4-4534-ad73-a549895b1639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039255, "uuid": "0ce3201d-4a36-4c7e-ad7f-ac2a0374abf2", "value": "9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10287d4c-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775039969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039969, "uuid": "5fe1a8c6-4a4a-4d6d-8a90-3031a498176b", "comment": "Malware payload (Mirai)", "value": "a6f1665af6729bc55a0feb397189d4a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039969, "uuid": "46791e6a-5158-4edb-ac5e-1743cba1e717", "comment": "Malware payload (Mirai)", "value": "9f777b4fac1d52ac9d8ade02c38dd235ee858906e8b3f225d4f5cc9fbb53ea2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039969, "uuid": "250cb710-2174-4ca4-b0db-65982a6fae66", "comment": "Malware payload (Mirai)", "value": "fc2effc78cb85a54ca11371edfafbd0667e0d9a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039969, "uuid": "33b656f7-4155-4406-b93f-03c3836fd1ad", "comment": "Malware payload (Mirai)", "value": "9c9b2573404a67220ce06bdc1e791ddfdec1504ed84642e8608a89d5b5d9f942f0871168c17cf1510dfe4ff3500fba25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039969, "uuid": "6fcfc4cc-7478-4ca1-b28b-646fee6a5a3d", "value": "T1F2D36CC4E64FD0F6E91211352176B7269A72FD3A113EDE83C3A89B62AC939C0D61735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039969, "uuid": "d971ad44-6c5e-46e8-a491-d0e9809e23e2", "value": "3072:SS3mvDmaFrp0nvT6jr9abt5O0Ju/Lm2t:V3mbmaIhykCLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039969, "uuid": "f407203a-74eb-4c7f-85e0-7e93e0a1abbf", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039969, "uuid": "b81ead84-bc62-4f14-bed2-1f28dfa0ae46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039969, "uuid": "c55a6b75-671f-4738-a061-4e4436a0b9f4", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c44a7b-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040084, "uuid": "0e0210d6-c09c-4575-8de5-d81604dd6f7b", "comment": "Malware payload", "value": "c4a56c8466e2fe76002e6cf806023b0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040084, "uuid": "2e3166c2-8947-495c-9cf1-99090050bb24", "comment": "Malware payload", "value": "9fb82d137cef8056c62cc85ba2c04e8776074e8e54d1da80f90596cc07ecde33", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040084, "uuid": "fd4d3425-545c-426d-9c05-e978d5c30a4d", "comment": "Malware payload", "value": "51711102eda0565f5cb040457f855063e332bd65", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040084, "uuid": "74b4f511-d72d-457a-9a49-2e1c02a07a2f", "comment": "Malware payload", "value": "0919f805ab60d134f8050f589e111a0fa9f4c9daea712cb01411c5bae1c257a0aa7f3a5431e75f34be8842afc88e9d17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040084, "uuid": "cb45d753-f970-41ee-af35-3cf2d3897df6", "value": "T1D2C633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040084, "uuid": "8b136bfe-0e58-43f7-91d1-e8e6215d0ee9", "value": "49152:w6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOcw:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040084, "uuid": "2f343ad3-8ca0-4aa0-9b51-b194091f2092", "value": 12190268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040084, "uuid": "743f4b97-f50f-4f9b-b223-faafc60d6501", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040084, "uuid": "0f48b52a-ba46-4508-8ca2-62346490b123", "value": "9fb82d137cef8056c62cc85ba2c04e8776074e8e54d1da80f90596cc07ecde33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f7faad-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039165, "uuid": "a87e2567-b79d-46df-a0a4-1e91df770a46", "comment": "Malware payload", "value": "18e7a30204f3df7452b6ad95e442933a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039165, "uuid": "7e5e2394-1116-46ae-a13e-a54784535663", "comment": "Malware payload", "value": "9ffa2294f9e00007de0c84fd6bd073017e19b7cfe63ab6a2836781a62b739998", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039165, "uuid": "886c27b1-202f-41a5-b868-9d0bb50bdc2a", "comment": "Malware payload", "value": "6df075eff33ee520a0d5b8e13dc9b3ec0ff425b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039165, "uuid": "3fc3d6e6-2ac2-43cc-a40e-3d3096a167d5", "comment": "Malware payload", "value": "15da18fd1e99e8078d89a03280a3cfc699c056c7a6c19326cf1a822e06af6be64908178182e9b8464096e99567c98b66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "octopixeldate-com", "colour": "#EE69AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039165, "uuid": "baa18dd6-6011-4ce3-afef-1ab129498ac0", "value": "T1B643C8077961273FE65DC70AE18409BC975AC35D422BF17DC2DED02F180DE8EA632AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039165, "uuid": "a0e1d9ae-f553-4d97-9f40-647d8f2593bd", "value": "384:/8KO1MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGvc3Zwth7Lpfqz+DfTTb3oLnav:COOq58H8XtO8fpE3ZwLLBqPiRzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039165, "uuid": "2ae2b0b6-0a1a-4b01-bc71-3c2d6e835e02", "value": 57709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039165, "uuid": "5a6c46e1-2661-4b3b-8e48-bf830da92bfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039165, "uuid": "4e4de2eb-9c65-4b70-8cde-8ed43264c09a", "value": "9ffa2294f9e00007de0c84fd6bd073017e19b7cfe63ab6a2836781a62b739998.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dab19a-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080800, "uuid": "18932cb7-96cf-40ed-bde3-bac19038bcb2", "comment": "Malware payload (Mirai)", "value": "cfbcd2cc6467a05223eb27bc58eb8984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080800, "uuid": "89dad124-d105-419a-a955-ebf324393d72", "comment": "Malware payload (Mirai)", "value": "a0083ff6091e118b5568ad118a1b20568d6f93f1297530457ca3161364e8e5c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080800, "uuid": "8235ee97-a625-4974-b6af-96703bf83ee0", "comment": "Malware payload (Mirai)", "value": "27ced4d9be1e6ad92bc9b36c86e252122e78c073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080800, "uuid": "88395488-67f8-401f-be42-67a0d29899eb", "comment": "Malware payload (Mirai)", "value": "4db86b909d30324f1a8d554a16d282de2f6829fa040e77f9c0bdbe63d2d9de36a7a3784d44cc06af7e42e3b16207e86e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080800, "uuid": "c2878225-33e9-42da-85a1-03fa685d58c3", "value": "T1CCE322295638D2DAF81C207514489C8BA23BE63E156CDF1842CDEF4201F87B64A757EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080800, "uuid": "ef39d579-902c-4c09-90f8-d6026d26d7e9", "value": "3072:qNaRRpOZbkKMD7/s9yhAQGV9WOcSJAmf2VcQhdhcZSo3jsx0laGif/m:9LOZbkKSQghAQGVXcS/eXDcZD3Y1fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080800, "uuid": "37f18bdb-ec76-4987-9a2e-861ebf8df288", "value": 148268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080800, "uuid": "317c0d8e-e962-4a21-a11a-d2c5b7d36e61", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080800, "uuid": "600b3caa-fefb-49ea-b203-1adc1d7d7d64", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f5fcfe-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775050547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050547, "uuid": "d17d4d78-56e5-4ccc-8526-be8a47bdab72", "comment": "Malware payload (ConnectWise)", "value": "c246653d13fd79e28c8c59b79723d60e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050547, "uuid": "16e64ea9-77f2-480f-bbc4-b666a8e3062a", "comment": "Malware payload (ConnectWise)", "value": "a01fcef1589d5c5f6dab4ceb5648104fc3f224d1d25ebd8bd8160c3dab95bfd0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050547, "uuid": "400e19ed-72c3-45ef-ac50-b2d7eeac3e54", "comment": "Malware payload (ConnectWise)", "value": "466aeb13a7523dc29e9a2ebd5345e99ab6da55e4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050547, "uuid": "b58a5096-ddb3-47f0-ad36-77096c933d52", "comment": "Malware payload (ConnectWise)", "value": "f118d6ab0a0903d31f224cd42506aaa94362efff7c5d5d2ef7ecef16239d084fdcd0be4b8ceb2e3e26f57761e037bfc3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050547, "uuid": "23c7c7aa-34cc-43ca-99fc-cea49e79e097", "value": "T175F633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050547, "uuid": "534d0fe7-c3a8-42c6-ac54-b0aa8849b6d5", "value": "393216:IOvTi7hha62J3N110OvTi7hha62rOvTi7hha62sOvTi7hha62:IOvjJ3710OvjrOvjsOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050547, "uuid": "24c52a8e-635d-4f3e-b9c2-de0fcc7b0814", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050547, "uuid": "09807ccc-1df7-474e-879c-deca5b13af30", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050547, "uuid": "93720940-2695-4496-9e5d-a98c1bd9bc7f", "value": "ScreenConnect.ClientSetup4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f31507d-2e11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078864, "uuid": "6160cc49-0ae2-4064-aa82-9111b5ffdca2", "comment": "Malware payload", "value": "2720bc3518bd4a51fbff67c94417712e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078864, "uuid": "c5dccd83-10fc-48d5-9d0a-b64f93b13a8e", "comment": "Malware payload", "value": "a05398e8a3cd5d7e8d707faf2da638f5d4f187f26b67cb4cc0ae3b614d4726ed", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078864, "uuid": "066ac6d8-134e-4221-ad55-7f8f6ea190fd", "comment": "Malware payload", "value": "282501dd74522f164df16206f04475ce816627ae", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078864, "uuid": "284b2480-d83c-49cc-9ee6-3cb28bc37d3c", "comment": "Malware payload", "value": "a042ebf9ec36a1455e2d6ec0c1f1e9cac00d2b078ebe01c4a5e612ffc7e661a8a1f7fa09909d309c4b03564918db4a09", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078864, "uuid": "88dbaaae-69b3-41cf-849c-d482de84d765", "value": "T18D3733A7A6CD067DEE17E41ED8F2FD065B9F8907B49319AB9D8DC1C5C82238736D8900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078864, "uuid": "590d56de-7832-42e3-be78-983bbad230f5", "value": "393216:+oHp4RF/UY/L/zoklpHtUclTdqzwJemUzv72mcegAW7+3Yqj:+gKF/UY70IpH7JdqzwJVeTW7grj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078864, "uuid": "fd3d0a5e-f8b0-4007-85f6-daf55d50239e", "value": 24327008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078864, "uuid": "684e8742-c608-4a1a-a8dd-b50f43993179", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078864, "uuid": "9d967a8c-e844-4cca-9231-f938ef44094a", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cd4841-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1775057667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057667, "uuid": "a485fbd8-8251-43c9-9a65-1ab1b7d7af02", "comment": "Malware payload (STRRAT)", "value": "d884766281d9e17390f09d0c5aca95b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057667, "uuid": "fc0817e6-45f8-4983-a8fc-5b744e63036a", "comment": "Malware payload (STRRAT)", "value": "a05e19a327fb6c9208abf7866ef09c5efffabc04a80456b49c81c790a40880c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057667, "uuid": "5eab100c-6193-4dcb-b781-25a48ba17ef8", "comment": "Malware payload (STRRAT)", "value": "f18ff2db1a3f1fc79a41d4ad1d90e5e29c9422cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057667, "uuid": "134f75fd-494c-41d3-b414-08efe76dfc4e", "comment": "Malware payload (STRRAT)", "value": "ffdf98255cc377394c57f819d6ae2f417ebc089b30bb91f697a3dc980823ad8338d94ae6b4813834dbef8e11ca63e53e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057667, "uuid": "b7f3e95e-0bab-4a62-81ab-08409685d615", "value": "T1DE0412EA18372DCD4D08D98D66B9AE4573D99BC600B02DDC6367E8D8024E8DF720FA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057667, "uuid": "1c9a9a26-07b3-40e9-8958-f7794d966620", "value": "3072:OJEYSRS5ZL3DoZzV07By4A+Un4KyJFdYqABQ7MiHWWMWVKkAukKx/8h3YdNQ:/S5Zo7078nJn4Ky6qABQ7+WX0hg/8hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057667, "uuid": "ae26de39-2f02-4594-8b64-a6e3219bfe4b", "value": 189917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057667, "uuid": "5ac0fe8f-3064-4169-8682-ab9903ee38a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057667, "uuid": "5e421383-78f6-4464-bac6-2f6b53f3d701", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e295af-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775060330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060330, "uuid": "33d82432-c391-4652-ab3f-ef181d7c0d37", "comment": "Malware payload", "value": "51d8ab1304911159e6a0cf58db28c8df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060330, "uuid": "7d52961f-77e6-4688-aa68-610d8694095a", "comment": "Malware payload", "value": "a16a032715293133f2fa8ee63c10caf0eb3508a478141527e200bb00a128c2df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060330, "uuid": "65144c09-0bae-4cf9-8b3e-57fe7cae4ccc", "comment": "Malware payload", "value": "ac45a13d0f0dc3fa530bcff4159be66eeff2e88d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060330, "uuid": "385e2824-d392-4520-8d5f-03a83d183beb", "comment": "Malware payload", "value": "92cb7c296d29c7cfa3744a0b46e0df088fd881c8cd26f7a53c3b853bd68cb4c59b4ca6bfec5dc033c87354e9e4a75f29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060330, "uuid": "1317c506-fef9-444d-8a54-9bf6de319453", "value": "T1AA14C80A3A228FEFF16D877147F34A31976976D617E29684E26CD5101F203CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060330, "uuid": "ac254bd2-9546-466e-a444-d801ee9967a5", "value": "6144:rf6ir3oR6xPv0L7btaWp06GtCqjYW8nY1j20WI:WifB0L7Xp06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060330, "uuid": "fb3d705b-9bab-4bc0-997f-0285188342e2", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060330, "uuid": "e29d37dc-950c-498e-b24d-7983f22d3592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060330, "uuid": "a7cc5f3c-505f-4ef0-8562-e6f33b2abf41", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807c78e6-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775060774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "0c796ecb-7acc-4afe-9186-26a02203403c", "comment": "Malware payload (Mirai)", "value": "dfb3c52aad8900c82b8b6b7c6e55d1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "d3b274bb-23de-4acd-a225-e733d87ce8c6", "comment": "Malware payload (Mirai)", "value": "a18fc0b5c985173cf7db7d3507c773edfd5c40c3f709bd4e992007ca8aadcb72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "606d1c34-549d-43ef-9d01-0d80fee0a660", "comment": "Malware payload (Mirai)", "value": "4213b7f2e1e5128f4fe919a81c2bcdd1af4affac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060774, "uuid": "e47d408d-1006-485b-a15d-e08e91a0e033", "comment": "Malware payload (Mirai)", "value": "70a29c8e3be2e3383d3802194b76e6fa3f66c5a5aa465c76712e86e50014808e76e87a7733eb10b9595dea6812c19d1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "88e73de1-fd1c-457f-b3cf-91d8959baf9d", "value": "T1B2B30945F8505B17C6C652BBFF4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "9cd79c69-9a7f-4554-a28d-0cc2daba0f6e", "value": "1536:GUi9yqnU8vGRz4VA4j6TJGK83y6OxV5Zpq4cxblK8wywXvqcVKaflP9wsA1nvT:LaxnUHz4Z+tGxgnvmE+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060774, "uuid": "2849e93f-d04b-4b6f-826d-157e603fa71f", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060774, "uuid": "f8a31e33-2150-42d1-9a10-01c55c033ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060774, "uuid": "f288764e-788f-4b46-a985-952b306d50d4", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79be4895-2d67-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775005787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005787, "uuid": "43845f81-3b9d-4892-86b8-b9e5097e75c7", "comment": "Malware payload (ValleyRAT)", "value": "c893a0e03b6acc69d6f52dfc6ef32bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005787, "uuid": "e409852b-efe5-4fdc-b5dd-5f5801f84de2", "comment": "Malware payload (ValleyRAT)", "value": "a1a0f35f0ac483a6c5649f6fa338952c2d2c457d2cb1b2fcef16bdc96fdfdb8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005787, "uuid": "d0523c5a-6a7f-4454-a402-942cd126251e", "comment": "Malware payload (ValleyRAT)", "value": "d6065a1937cf79b61c714f15c0ab021e920a7476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005787, "uuid": "ec9a7f84-da90-45e8-8e19-bab36df1ba91", "comment": "Malware payload (ValleyRAT)", "value": "1836370afba3b15b00d7c2a394804bb99bc8abfe0cde60b0477cabfdd3fdc2f2d6f5ec375644a1618e357261dcf3210e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005787, "uuid": "5550f3de-ccaf-4e2a-9c36-8fd62f44bd02", "value": "T14BA4071FC74934ECE239F07C9E172661B925BE184B2857E3B09199250E72AED7F78708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005787, "uuid": "65cd5888-962b-4445-9536-ccbba99ee13b", "value": "7a15cf80d129fadedf5f35c9333315ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005787, "uuid": "f950128b-c73d-4d11-a062-3dfe8d222c92", "value": "6144:enEWmy0PptSlh+GVfoAKo2kpAprA/DA18hY1:enplh+GfoAKo2MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775005787, "uuid": "415f9205-42fb-4e7d-9f9b-5b293cfb81cc", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775005787, "uuid": "1a5a6123-a217-4d52-a6c0-c1bd191d5c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005787, "uuid": "f0cf9f89-9599-4a1c-8c54-ca45eaa0a161", "value": "r6mrA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f36a8f1-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066838, "uuid": "1c8dae24-71d2-4a3e-9310-4cd991bffe24", "comment": "Malware payload", "value": "45555afdb1e14a75e88e90e5a2d59b46", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066838, "uuid": "98f0d00b-c669-4c39-8a07-5caf053d803f", "comment": "Malware payload", "value": "a1dde23ef17bd92518ca5955e5a64375009a801aacf927b823a9c5ed1ce60877", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066838, "uuid": "89154720-eb42-4a88-b5ec-eff37b7c7409", "comment": "Malware payload", "value": "5756b2d93683b1e19bf321a4a9abd3cf96eff139", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066838, "uuid": "4008467d-d440-4531-bfa6-7184d8f93517", "comment": "Malware payload", "value": "0f2352de90d629f7bd98e0551cdfd51a0979cf2c6ad92f0df99788d6f72b1cd03db8b99a05e3dbfc6ecfd4f411750f67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066838, "uuid": "656c6c5d-a51f-4af3-8f61-1c830b29ba22", "value": "T1DBF2F180B9D817D5E4189375E8F2AE40990155CBA1C23C4073A6B6E82B429E8D7FBFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066838, "uuid": "5f7aa79c-4827-4d19-8007-38d0d7cf3df8", "value": "768:mZwOJ1GXMuhbTb+6KBVI9u8xGyfy6cuP1mALJgBfwzsV32PerhyYY:mZj1EMmbT7PGqp9mAIHVmPerUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066838, "uuid": "4dfafeb2-4b19-4b1c-8dae-1e6039f5c7bf", "value": 37543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066838, "uuid": "d5236f01-6164-4e8e-b3b4-e00507f34ae7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066838, "uuid": "cf46b353-c958-4d02-aa9d-2f4d70861777", "value": "Dienstangebot_Zapfel_T_27-03-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b2f46e-2e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775083386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083386, "uuid": "2657b107-0995-4108-90e1-1337a973743d", "comment": "Malware payload", "value": "f37e7d37a118f1b76dc56fedf4f2820c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083386, "uuid": "7489b55a-c275-4c0d-b95b-e000c412db06", "comment": "Malware payload", "value": "a2185f723af4f4e6daf60350bb74d3747d6c9af51a27bc3ace646a79d7931d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083386, "uuid": "78b07c0b-4aba-479f-83a5-9ccb72e40dea", "comment": "Malware payload", "value": "30dd5910916d4753c6a9caa2bddc004bb1961341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083386, "uuid": "bae2519c-e067-49fe-b731-029a2acdfb26", "comment": "Malware payload", "value": "5b65692f62dd3258b04215a87d20faf55150b69c87dd754570f87926625e621e5fe220e500559d62314421f075b8db3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083386, "uuid": "566c7f36-8d7a-4bd5-8726-2a65a968ad8e", "value": "T13CD38C26B250E03AC0D3253089B9DB7269BEB92153A844CBFF941B7D2F743D27A75346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083386, "uuid": "3a6a3de2-1ce4-445f-b9d0-020c51cf06ef", "value": "3072:xt53U/CcRp68AaITRpcMbiXfLRxLjXEPdZN:xt53K68AaqeMbYRZAFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083386, "uuid": "6c075fe4-941e-440f-85c0-27d1da1d4648", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083386, "uuid": "6c42b36d-d9e2-4c86-b272-6e967f5e7d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083386, "uuid": "f084e957-82f7-4f2b-b7ec-5fe813ab49fd", "value": "GameRepair.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18a7155-2df7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775067782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775067782, "uuid": "edb17c4e-efc6-4d26-aac8-ecc6ccfd7755", "comment": "Malware payload", "value": "fb0e92c4b09a05049458ac1d397e7170", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775067782, "uuid": "11cbb717-31b8-4aac-b238-b94dd93154f3", "comment": "Malware payload", "value": "a256130ed2268c547b39a22cf67c7b224d267df30db296e6d0e47cf23392afba", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775067782, "uuid": "1582cff3-b166-4e53-adf2-c4f6e3f9ff57", "comment": "Malware payload", "value": "da8db08c191ca8aad9fc9a21ceeb7123d79b8ff8", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775067782, "uuid": "983e4938-d4df-4e56-a4a2-65ba4a32a109", "comment": "Malware payload", "value": "bb3fa3006a3f10938d6f4513a3a4b8439f3397f810d8e07412e4ed3b61c92a9615e224a056a18c342389a8f44185f26a", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775067782, "uuid": "93141bd1-a1a8-4b3b-af3c-6d95ea6c5111", "value": "T15B93E0007AFD3B01E3B24F34463A7B250936FA16CA73E24C05D0F84D6DB9E00953672A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775067782, "uuid": "80f0b7bc-071d-402b-a970-a9406febe4a8", "value": "48:TE7nRnR/EiY76KedN7nRnR/34LjJRTJRg/Q/+E7:eRR/EiCm7RR/3SNrt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775067782, "uuid": "10deb10a-bbf9-45c2-947f-5d67bf26b1d1", "value": 97659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775067782, "uuid": "46a29883-ea04-46cb-934d-e8f2ac5fa798", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775067782, "uuid": "d97c4c33-aca0-48f7-a704-68e72f08790b", "value": "Dodatok_1_do_zapytu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0505566-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041634, "uuid": "96f2d3d7-c290-40df-bbb7-f44ad78d0e7c", "comment": "Malware payload", "value": "283fd537b378772c4d8f8a2d005c3324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041634, "uuid": "cb392171-3cb4-4426-8f91-f76ccbdb0ee8", "comment": "Malware payload", "value": "a3a4b852c94808c7a4484caaa441698fc34cb452bf62d363e55a180ccca84465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041634, "uuid": "bd2faa10-ce61-4c30-bbd1-6c9c5a9ac1be", "comment": "Malware payload", "value": "852d062d63b22c7654f2b1e72e771394da740827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041634, "uuid": "236e141b-1c3b-4939-bada-53fb53a2725e", "comment": "Malware payload", "value": "c0361a5751ef6ec214ef381a08d16c01f74397d90cd3144f788054ff081b0a78247191b4f5af7b61e34fd7fc7c400bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041634, "uuid": "6052154f-2943-4b48-a617-d3956d631903", "value": "T1F5C63385239509D0F49FB23D59D14A6BC3F2B4201B71CA8F1BB04AA92E672E5EE31F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041634, "uuid": "5a319925-b09d-4605-8c0f-56b429fac5e7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041634, "uuid": "c427be3c-f6c4-4633-8669-94aab6b306d1", "value": "196608:aAAE2zH1tbW897G+x7eovq5XMP6PzFc4eukppHsoqBbRjMF17:lF2z11Fdq1B7ZeXppHsoqBbpiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041634, "uuid": "0b8ed7e0-cf01-4986-a045-3852a291c4d7", "value": 11702159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041634, "uuid": "3ef56ecc-82f1-49b0-8459-82c0685c0179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041634, "uuid": "8a218f12-922f-4539-8ed6-823c1aa5a42f", "value": "TriggerFinder_DZ7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adf17bc-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053785, "uuid": "12eb3805-3c0a-4002-ad60-fc69de280c88", "comment": "Malware payload (Mirai)", "value": "df0db3fe51db17f25547e965133f156d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053785, "uuid": "c7953966-e8ae-4704-a3cf-2911561a7bdb", "comment": "Malware payload (Mirai)", "value": "a3bc6d03b87ed3649bea229713f0044c275921324dcaaaa66b415565e4484343", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053785, "uuid": "d167c390-df62-440a-9b3f-36c7e54f56d6", "comment": "Malware payload (Mirai)", "value": "f87dbbd39bf3d41bb0ee9f0846dd674756a3bdbd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053785, "uuid": "446ac0cb-08a7-4e00-860d-3a8138463062", "comment": "Malware payload (Mirai)", "value": "501f46851cfc2248279923773a1ae0ccbad352763a7a07d0f2609366d315f151094a600bac05336c3186b332c1461eb2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053785, "uuid": "affa4d98-f2fa-4eec-adc0-b0b309dcdd19", "value": "T170A1E5E974B5937B2EB0ED7371D6CA52F14021A7E0C91D0AE6D2F0E8498DF61F484B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053785, "uuid": "eab910c7-0a35-4f7d-b1ca-c17089db6ef9", "value": "96:v3LAdSAbXAXTATGEp6A7ZAFuAjUAfnAjRAtEAr4AjpA/zT:T/I2+G46Kfl4YRZUmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053785, "uuid": "33cb41b0-9a6d-4429-8839-0fa3753c8b9f", "value": 4835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053785, "uuid": "8d9ceaad-3fa2-4957-846a-331a061f143c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053785, "uuid": "fb315566-3c0d-4e68-ba03-7dc54315c81d", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0604025e-2e08-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775074742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074742, "uuid": "13bd6c02-6bfd-4d26-a1ca-2bd7db3b01a1", "comment": "Malware payload (Smoke Loader)", "value": "a8c39984e7c18ac5c14976b3707e53b9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074742, "uuid": "bacc9392-6cf2-40e5-ba24-92f85fb43eb3", "comment": "Malware payload (Smoke Loader)", "value": "a41888572af2c2a229dd1ac33f9d18ec683ae8941fcfd295d253edc52e8ff347", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074742, "uuid": "3b8ec5d2-3454-4199-9b16-93f9c60db7e6", "comment": "Malware payload (Smoke Loader)", "value": "a461bd07c6948563297a2e52697159be847cb6e7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074742, "uuid": "c0534e94-e225-42f6-bdd4-8763ea748fc2", "comment": "Malware payload (Smoke Loader)", "value": "97bde7cbd973570195d8149f9ee09fc9fda1bbc6892782fb950062e5e0d8a8d4a4e6645648ec9500ad8f6a3a64284aa8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074742, "uuid": "f2b4b31f-ffe1-4a68-ba75-78ec174ff515", "value": "T1F4D4EAAF6A3065D0C9966AFCE4806D0183A07CD4759E45DB12B6BF17BEFCF93AE08054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074742, "uuid": "a636624d-a990-4b2c-9b68-9d1c7bdb8759", "value": "6144:sIAuOq2qDMZhvN8hppzOVTsMXxade8nF7Xb+ofGgts4Vr11OGcF+:DNDKNgpMXxuH7Xb+kGgZlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775074742, "uuid": "3dea833e-e478-42a0-883c-c548dc5d9666", "value": 625200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775074742, "uuid": "8b94db2a-4e5e-41b7-b176-c3238b2f6ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074742, "uuid": "f91e0adc-d86a-48e3-bc37-56e26041c1b5", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedbc01a-2dab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775035082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035082, "uuid": "dc47799f-8e1c-42b6-a462-fea6ba36f877", "comment": "Malware payload (RemcosRAT)", "value": "576f55fcb1df55a5538f2f35c85969f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035082, "uuid": "9fd29194-f589-4ee5-a49e-c7d670e53e76", "comment": "Malware payload (RemcosRAT)", "value": "a51941c053e0edcca2368d4c0e08878b04c497e8aaebe5621386fbd10d7122bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035082, "uuid": "1f5ec961-8dae-4ca9-9385-62e773513c75", "comment": "Malware payload (RemcosRAT)", "value": "1f21618716cadb48271e28fd30b8d048e703eecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035082, "uuid": "2ecec6f3-978f-48e1-90c6-19d5682ed961", "comment": "Malware payload (RemcosRAT)", "value": "d2ed4ec8b976fa23cf5751d9549edd80b42ab839207a5d301de2c1ccf617c3128f10292ee0b3fb9c226e87bcb61eb05c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035082, "uuid": "297d3709-e26f-49b7-af26-4e953d3cc9a6", "value": "T1F255014023A9EA02C0B72FF00970D37457B85D896812C317DEF6ADEBBD7E795580A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035082, "uuid": "fd085fa9-6dae-4648-9b76-2b7108e4bbdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035082, "uuid": "9c78d9f9-0487-452a-b1d1-9005456a253c", "value": "24576:3/mOASHpQQ8qadm2afyhcg3erKqm0DfisOwJzYLQ4xsc+6uabCvnUHx:uFSHpQQ8qEmRfyh8K70RZJn4OcHqnUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035082, "uuid": "1cdc5400-6842-4c07-99d3-b779f0738ff7", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035082, "uuid": "75dff7f8-073e-4404-a9e6-7f77b5d68afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035082, "uuid": "3ed4cf02-c863-4588-a0ef-7219e16ec111", "value": "EXPEDITORS VGM Form(CFS) 3.31 2026 - QMSP169913 - 4812893341 HBL#6810984029 (Lantronix USA-SEA).scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67189a6-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775028625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028625, "uuid": "8aec133c-fde9-4df6-b050-4f4a3133cd34", "comment": "Malware payload (AgentTesla)", "value": "c7732be14452d6100baf32d7e95479a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028625, "uuid": "14f334b3-3012-4818-bd1a-0f732562b44a", "comment": "Malware payload (AgentTesla)", "value": "a52d7e811609cce5a2aacaf70a63a90f4aebb324f17a224b043069c4f7384ac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028625, "uuid": "486e7c35-69b5-43f9-bce2-e89b52c995ea", "comment": "Malware payload (AgentTesla)", "value": "41c52861f713574642c6c07774c700e861b0c21b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028625, "uuid": "a93868fa-f28e-4c0c-b8e0-c2c02905e295", "comment": "Malware payload (AgentTesla)", "value": "5027c3965c5fb0e3d66a1c93bd5045d2e94b7127e602f1ae960ed9c0245495e04a88cdb30d034c9b1a5bc64b5f8a5bc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028625, "uuid": "f71a99aa-1aa8-4861-a55c-2282a3b94f49", "value": "T19B541250329CC853EBB79E316D79072EABF6AEA5017643672721AD0C6D523C1AD0F783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028625, "uuid": "62abf65b-fc09-4a33-8abd-b0e50a0600ee", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028625, "uuid": "87495b84-d325-44f7-b287-f11393e2dfb6", "value": "6144:dMm4CCNUtiBruCrYjThO6QMp4kn5ZlGuaJ/NZXVSYO4qEfR:dMwaUtiBr3YE0fn5ZlxavlOVEfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028625, "uuid": "455da9bb-3462-423f-ac6d-83eeb7a00a6f", "value": 291416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028625, "uuid": "6f9b2849-e78b-49e5-98ca-c0ddf99be30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028625, "uuid": "6b86a814-4b3c-45b8-b3f2-43bef3bbdc5c", "value": "xls55738471009384263103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97817258-2dae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036331, "uuid": "a6b7a80f-8a37-4337-8bf0-110e8166dc4b", "comment": "Malware payload (Mirai)", "value": "0f5580bed510a3c7f106c7b43c05f67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036331, "uuid": "6d74cfbd-30e8-4c59-adb6-fc0b661e72f6", "comment": "Malware payload (Mirai)", "value": "a65211cd909a1bf9ad9c528f9e49915dda62eb23d104d5f56772cedfefc9656e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036331, "uuid": "82327444-ed96-497f-abcf-768bb0872ac4", "comment": "Malware payload (Mirai)", "value": "de0b1302319342744683c899e706362587609f3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036331, "uuid": "fcc83ffa-8c60-45b7-94fb-c8f146a77034", "comment": "Malware payload (Mirai)", "value": "e584ba52dcdf291ddf931a0c4bbb6e7a5d1fcb1ee8b4c764bca3c8d68293f0c0ffe318860e113965331d71d69163ca7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036331, "uuid": "df41f945-9461-4f23-91eb-704311823660", "value": "T1027302BC070498DECD607AF782BA4B521F410DB910C6DD40E9A6EA622EC71743DD7AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036331, "uuid": "6e35ae5d-7509-45a5-8c25-180e910ad7a7", "value": "1536:w0B3b87urwemjU1Fh+V3z6HdTSPzy4JTJeSesSg0uqAvyigVJu5:wwweV+VGHdTyf3esTqlZVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036331, "uuid": "aa9cdc24-5659-481c-a0a6-846bff3b8f02", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036331, "uuid": "93588054-f566-4f57-a410-ef3b36a4912e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036331, "uuid": "020b0c3e-7131-422a-989d-887194cbdb1e", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9074b822-2e02-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775072397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072397, "uuid": "e2bff58c-0119-49fa-8caa-32ccebd2cf92", "comment": "Malware payload (njrat)", "value": "010847b9d43887efa305e74cb206d62c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072397, "uuid": "be9fecf2-dd28-45c7-b030-a74c07629cf6", "comment": "Malware payload (njrat)", "value": "a6fe48609e883ccedff1a74986a61fdf9f3bbf60340384ebba8e28a03bbbabc5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072397, "uuid": "9f698a15-9ab5-4f8f-8ea1-778f6575f5b4", "comment": "Malware payload (njrat)", "value": "2b69a993f17f07c78d724cf7849d30cf19efd3c7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775072397, "uuid": "435cfe8a-bb43-419e-9056-589729a6a45a", "comment": "Malware payload (njrat)", "value": "cbaee310d389ebc7ceeaaee4fef3b2e8997f6a87ba78eaa0dbfbdf9176581f616a64c57f9102a79bc962832093063aeb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072397, "uuid": "f58f5217-a30e-411a-9f14-5fc386f366e0", "value": "T17945339B16508160D94B0B30825AD2ABBD3D6E47285A4684A1EEB7C81DF7F4187FF0F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072397, "uuid": "2f4f26de-0ee3-4ebc-8ec4-cdc69acff6c8", "value": "24576:sYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnkxYCX:vQSadD+RwsLdaCPNj96gGKbBm1mndCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775072397, "uuid": "29f6bb3c-6a72-4847-aa83-1ffcf52f38bc", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775072397, "uuid": "f3556945-1dd1-4591-a73e-b1bcece3d5ee", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775072397, "uuid": "2059ebcd-eeba-4f46-94e3-a1e568cbcd16", "value": "SetupMT_V6_956.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56453756-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080889, "uuid": "c68a860b-8ecf-457d-8da8-faf90364b179", "comment": "Malware payload (Mirai)", "value": "d10854cf08ecab4c14553591d93b7e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080889, "uuid": "dff7323f-56f2-402a-ab64-6b1c02c294a6", "comment": "Malware payload (Mirai)", "value": "a730713e70cbc897b6da752ca0e7d053bef68196a81e88b03d117235ea226400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080889, "uuid": "bfbf73c7-e114-49ce-80d6-69081928f4fb", "comment": "Malware payload (Mirai)", "value": "f5de88a75c73731810a444f851c52195b64243aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080889, "uuid": "7d56c341-65e3-453e-b14a-c0c48947d03c", "comment": "Malware payload (Mirai)", "value": "0f9be53c50000e6078d43f1b4f7f270885da727796dc2a22d8e7d53e5cca55773ea7f6f6342769b0ba2bf1f47910d9a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080889, "uuid": "3e48d94f-811a-497b-9143-ce0ef4b94965", "value": "T116847CCCFB4DFF42C28293B6E96B0613B33934607B4A95637D12213EEC967986C67146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080889, "uuid": "799d93a1-3dbd-4328-aacf-6e17d30e296f", "value": "6144:uvUcfDbnGU7nguKEr4STcc8EIKQgHCKmXr4nQWAFLohjE0y5BtyWZ:7cfDbnGU7ngXF4T8rmQWApoh2BtLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080889, "uuid": "de6dfe04-aac5-4b24-ba56-b1f179477f04", "value": 371368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080889, "uuid": "f7ee1df4-bd10-473c-b92d-998ed1dfa476", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080889, "uuid": "e029111e-3704-43f9-b3ae-c3f3039957bb", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6322aca-2de9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775061723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061723, "uuid": "2b58520f-27f4-4056-b585-14eae61df857", "comment": "Malware payload", "value": "12f8287f73f9853be77f9a1f42927f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061723, "uuid": "fe04a56a-d8a8-4ac9-8141-e60564e2ef8a", "comment": "Malware payload", "value": "a7a7a887247db3707b5eb522d9530926aa6f0298ecff2dbb1d5e09e4949de07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061723, "uuid": "dddcfaac-f121-4336-b58b-54f0baa566a7", "comment": "Malware payload", "value": "aafa1e49b984852b036efde514a2e29ab10aff28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061723, "uuid": "eab9821c-5789-4479-bf82-3c0ee9146309", "comment": "Malware payload", "value": "2d064dea7b7f9ff2ed405cc03f86175ef56686096c422bbb9541f5899ffc90768cb30736825a2ba7b1a462e94058bcdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061723, "uuid": "a0ff82a4-d4cf-489b-b617-133bc82ae0f6", "value": "T1DB736C4173F8606DE6AE8B3DACA098B10E35B5636F2ADA1C1D46905C4B65782CD70BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061723, "uuid": "f64c4a23-366c-4cef-baff-68d9397799a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061723, "uuid": "02a6ea61-8c77-478c-9106-772495e90feb", "value": "1536:Nj3O+Bocwbg29PsKpN+LFLUBUDEVTsqa4tsi5Bl+xO6lcwbmVCJNb1AIR:NDNr6AX4tnfclcwbmoJ115", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061723, "uuid": "1b80fe89-e13d-433f-bfa8-6cf618ecd5dc", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061723, "uuid": "c03ba983-2920-4f1b-b9bc-060d9c1501b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061723, "uuid": "7ffa1c53-7ee5-4fe2-a3c7-adf6906c7c35", "value": "ratonClient (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151e9e54-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053722, "uuid": "4d3c920d-4def-44e8-9be1-165719325c8a", "comment": "Malware payload (Mirai)", "value": "d73f672757b149a061ba0300f8f656c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053722, "uuid": "d7f9fc5e-f054-478e-aac5-7f07e04bddb0", "comment": "Malware payload (Mirai)", "value": "a7cff66daa4a2ba107132ac7e1855c3b5c96a22795488d0fe2fdb5c6cf554098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053722, "uuid": "7ce2060e-cb07-4500-a138-37e61e0ee1da", "comment": "Malware payload (Mirai)", "value": "0e19389d685bf5557d4b4c5d046493f4a8ea35a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053722, "uuid": "1e927344-b583-4f42-bf37-d44ee3877fca", "comment": "Malware payload (Mirai)", "value": "36bb298837ab8a9237379bf1e3d49ab65e237c6f9b03b2261f33beb5a9856acd5659b38121d80d9da432e66752f573e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053722, "uuid": "b0577a20-0418-4604-a349-6311d01fc33b", "value": "T10F148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053722, "uuid": "6b415a89-53c9-4f4d-a934-7d33ad3acc27", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxK:bOVfbEdxm4iub4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053722, "uuid": "fa2ef889-52b7-492b-926e-f3141c609f0d", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053722, "uuid": "6f6f43d4-6e3a-43cb-b393-2ddcd8de61ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053722, "uuid": "78790f29-68b7-4cd2-9672-eb5656ef939b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff2da2b-2e18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082006, "uuid": "6a8cd7a3-9600-4b3a-8451-fcda10642ca8", "comment": "Malware payload (Mirai)", "value": "b40cf37119e55e765e1465fe4b1d2f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082006, "uuid": "72fe6f8e-4a3d-4fde-9b9d-463b4b2bc370", "comment": "Malware payload (Mirai)", "value": "a85e02c091fb2ae787c45b3cb9fe203a47b5292e582dd1c8c3191ae6865ca7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082006, "uuid": "695e0e5b-bcd0-4605-aae5-b3008b3ba753", "comment": "Malware payload (Mirai)", "value": "53ac3e090888bc4f990850f3d6cb8532f0f8feb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082006, "uuid": "139c4a32-3ae7-4971-8750-b4e382654d8f", "comment": "Malware payload (Mirai)", "value": "cdd430e3bcff87f93aab849bf9d4d50bf181ebe3931a27c1e1f65d69587a759a0b77f49c2a27037a79e6a89a9f2cac39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082006, "uuid": "2c383b21-05df-4405-8fb7-a42f21993e7a", "value": "T1A5A339A3CC762F58C628D5B5B0B18F796B93AA6081475FBE1967C27480C3D8DF5063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082006, "uuid": "d4c80177-e9a8-4468-8ffa-31caed8fa8f5", "value": "1536:TcufPeqU2CRKysVO7lQLPS9vbNkWuJxLcRhqrAr:3bU29yvoPSB5kWufLcLJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082006, "uuid": "2ad33717-9afa-4465-ac51-b924efad8695", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082006, "uuid": "3c3c81cb-a76d-445f-8e71-76cedd3245ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082006, "uuid": "5e3db3d7-2f66-470f-b33e-14f5f79fe7e5", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3493d686-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080833, "uuid": "27202c26-e094-43d4-8526-4fec9cb2a80d", "comment": "Malware payload (Mirai)", "value": "67790c53b311eda5cfa364422b583857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080833, "uuid": "188f15fe-95a0-49f9-b50e-28ddc4d83321", "comment": "Malware payload (Mirai)", "value": "a88151f4d17dde6859c4fe6e064de59355ee0965a62ef6f001571a315d50a054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080833, "uuid": "9930d35a-f036-4aa8-b802-40cedaae3c93", "comment": "Malware payload (Mirai)", "value": "24f6c761a5550470e1956d20902f470dcd0520f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080833, "uuid": "de340aae-4063-4e1a-9770-1072b1a3dee2", "comment": "Malware payload (Mirai)", "value": "9afd7ecb00bcd603aede1cf5fa67c30479add409a108dbeddd284abbd6e10eddf07a875360f47f47223fb5bc2c74120c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080833, "uuid": "4488ba40-940f-4226-8f72-d318ba2f5f43", "value": "T19454F75CF8809B79CBD0617AFA5602DD33374F24EBDA720589356B3437EAB25A43B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080833, "uuid": "b24d6af4-3fd6-4f30-80da-098d83fc0679", "value": "6144:ECcuY/tajcYKzIrrAGJU9r0dGZtum8YiNvrcYj6nIT9j+WXeEh+BL63Et45ciT3k:Wf/pum8Y0JXRQS5/Ldo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080833, "uuid": "b84b44c5-5375-4e7a-b975-95fa9250f710", "value": 300008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080833, "uuid": "27bb4444-2e25-4a92-bd23-3ea608af70d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080833, "uuid": "df91a8fc-1e54-4602-8994-21cfad23509d", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf08083-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1775040984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040984, "uuid": "c1a96f97-7c39-4b72-94d0-29e74d3825af", "comment": "Malware payload (AdaptixC2)", "value": "891195450ef26df7d92706b7f3f842d5", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040984, "uuid": "7d32f3fe-d477-4673-8b17-2c69517399e8", "comment": "Malware payload (AdaptixC2)", "value": "a985b3fab403ad6fbb5cc15a44912224aead9518ac6b970c0a6c303989e61556", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040984, "uuid": "26e1d873-9651-46b0-aa27-92fa963515ff", "comment": "Malware payload (AdaptixC2)", "value": "c56538f204b0d236786edb56362ba279d0a28fd3", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040984, "uuid": "ddba0e9c-4863-4954-8aab-d7bfa0ff9a38", "comment": "Malware payload (AdaptixC2)", "value": "4864269cb1997ebefc1cbf5a7cdd61751aab4fb59753b791ceb8bb5c6c4b90a393e81578f73f41adcbbaf7e7fe405520", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040984, "uuid": "6fe638ff-9c37-430b-9bb8-cb941141ac68", "value": "T1AE9423456678674AFDD19100ED349E7AA88016BE75223BBB02F3919AF9D6F50FC3CD02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040984, "uuid": "28ab70ed-001c-40a3-b002-548c6aa41228", "value": "6144:WuP/CNezp5Z9yMiAlp4m81+RJK4InDxte7CaSsG5mCMfpns9KyqNS7rHc+NLk/kS:T5Wr+bFInDX5/B8iMcfBhkO5uqzLOiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040984, "uuid": "24a89af7-c206-490c-bec8-b84ca5304395", "value": 443404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040984, "uuid": "8c2b8fd9-8b56-4fcb-89b1-9f2ea32c7ff3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040984, "uuid": "50452430-4f8a-4ec5-b338-42af4d1ff885", "value": "a985b3fab403ad6fbb5cc15a44912224aead9518ac6b970c0a6c303989e61556.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80005d9-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775057431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057431, "uuid": "eaf77c38-edde-491c-b177-2da255e61fac", "comment": "Malware payload (a310Logger)", "value": "68fb55a9f7ead3f0ea99139b3b4fb636", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057431, "uuid": "daad02f0-92f6-4d28-8f9a-e7d1007aa356", "comment": "Malware payload (a310Logger)", "value": "aa729acc21efe9f8c3d30063a1d12a2e3f75044353dc2050024775d5f46905a0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057431, "uuid": "b7955f02-ba52-47e6-8255-5567cbf6ed5d", "comment": "Malware payload (a310Logger)", "value": "f114965fedc9e9f1bdf4a43b0de7fa77a403739a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057431, "uuid": "1024e3af-a728-4448-8f20-cc47436abfe9", "comment": "Malware payload (a310Logger)", "value": "0c15121f87504d395fa078c9c28f3ef02aafcd7fe7f66b8ab2afdc3fb760036bd61dff92a8cf0ff13cf6d94090e8b1a5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057431, "uuid": "94fe0e02-2730-42cc-9ef7-a6c1009f4c66", "value": "T120C5021189C46FB9CFAC5B1C80FD160EA3F04A9E4456798AEB33BE47AFF7940111B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057431, "uuid": "f9268637-b3ea-40c5-813e-59e695dba625", "value": "24576:qWjync60hqjEiAcTMSj4SBYptrNjSrv7glZw+al7W2pCIOLeE9Tq/iJqCvX3Anm8:jmncs+2BXQmlyIAs6nNRGbKsD1dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057431, "uuid": "f683015d-80e5-48f5-a275-1e0eb5d72d1f", "value": 2550325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057431, "uuid": "5d7a81b2-d005-4d19-9a5a-7483259f9a5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057431, "uuid": "e4bfae4a-2f84-40f6-9887-828810315680", "value": "T.HALK BANKASI A.S,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b663b1-2e18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775081991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081991, "uuid": "ed242168-5aee-4f71-b7a8-dc68b5931f50", "comment": "Malware payload (Mirai)", "value": "14f513ac2f22f2cb6fa0e686b34e8bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081991, "uuid": "4c399518-896c-4314-932d-1db0751a916a", "comment": "Malware payload (Mirai)", "value": "ac2770f1ebe114b46c629944c75851fa666e3424bf21ff5f9974b968e9c5e304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081991, "uuid": "ce6bee85-d5ae-4d1f-b0a8-8dc3d49f8bd5", "comment": "Malware payload (Mirai)", "value": "5c740ff31e80049a53845be20901cec1d4a25af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775081991, "uuid": "63d8908f-458b-4f71-a9c4-d2dd6c16dd0f", "comment": "Malware payload (Mirai)", "value": "35e72fa3efe529e1b5a582869b8fc70f0dc811171bc192f38cbcacfe3a155ba1e2d7beb5de591683187d1a5766f04b24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081991, "uuid": "c3da40ec-191f-4e1c-9a08-54f5be77781d", "value": "T199B533CC8C1BBD31E28DEEB74197E4599A821093821F16D28A0F7AF09F75DB416F1E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081991, "uuid": "27c68bd0-5110-45ee-8adf-130d057b21ce", "value": "49152:/fN8kcMyWb/jzPb0zkCrYzDziPse4G3mIEr6d9Nf/uBwfjh12oFyU1c:iMysLzP0kCrb0jItdjuBwbh1ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775081991, "uuid": "23f38323-608b-4451-8ac7-3703c2bd5333", "value": 2287112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775081991, "uuid": "5b2c479c-5816-4f0b-aee0-7334db817ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775081991, "uuid": "54ac0e1e-1abe-4250-9c97-6d54dc6b5e23", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61026f5-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041644, "uuid": "cecbde0c-d17c-44a7-95d6-ecdd1655cbbb", "comment": "Malware payload (Vidar)", "value": "96d10494725bf2e9f28b3e9bddb2ae1b", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041644, "uuid": "0d5dfb34-30df-4107-bdc2-1e41927073f8", "comment": "Malware payload (Vidar)", "value": "ac3d335498c49a80fe5b6fe69b75cf601eb325fafad0c042f8e7f14ed047927b", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041644, "uuid": "109be3d2-1de7-462e-ae09-f6d69d1bf5f8", "comment": "Malware payload (Vidar)", "value": "0d8fb0d9d7d186fb40ae1eb929d2c70ffd9bd95b", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041644, "uuid": "cad9f519-39f8-4053-88c6-01175f70972e", "comment": "Malware payload (Vidar)", "value": "d1c012022238d95c2363a3879b539480970265bd566aa7b8121855c7d5f7c3ca3c0e04db5b0b7a81b30a4bcf252442be", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041644, "uuid": "33d1bc31-b177-47a2-92b9-a9e77b72a335", "value": "T1F6D5BF45B3C46AEDD516DA388B14E332C2B2B9234B76D0CB5A9AD30A1F779524F3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041644, "uuid": "efbba715-3c03-4f44-a041-bd904f2a1b70", "value": "0ae8636abd085fc1a449aff3779033df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041644, "uuid": "c2e24d8e-f3bb-4e62-af86-d0d1681f5a70", "value": "49152:iZHfskpmtqN/S0HBlw0kPQTU8Yh/3rtS6m4vcH1xvZKrB3FSc/NkCr+KhuggbE4N:eoPQTU8Yh/3rtS6m4vcH1xvZKrB3FScg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041644, "uuid": "56e63082-2647-4e71-95c8-192fff58a9c0", "value": 2998784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041644, "uuid": "f1964fd2-238b-400f-8f1b-3c03a20f1a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041644, "uuid": "8b2ef89a-fd3c-4e98-b48b-520f26f556bc", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a51c9b-2d97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775026429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026429, "uuid": "e579a25f-122a-4024-a722-0c589fd77cc6", "comment": "Malware payload", "value": "4e7cea3e3eaf195805374b5669a98074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026429, "uuid": "47d77906-e3f7-4e24-a7e1-b07f6ea8bb82", "comment": "Malware payload", "value": "ac8c29bfb3ce7256201f44f38ec70ab25b99ad907e388cb7df82ee1962ed21dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026429, "uuid": "fd8a2520-e58e-44ab-b110-1d9de0e37c31", "comment": "Malware payload", "value": "ddb6328b6eb0d3d25cf5bdde016d069cc48a27b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026429, "uuid": "73a348f1-8bfb-4bc8-9600-7f1abe184392", "comment": "Malware payload", "value": "08b908c98d3f9c60faffdb8e1eecf216b4174e5d22979b0ce606764d86000aeed4dbda90f523e8a737988d172bb79c20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026429, "uuid": "87b8c485-9f65-4b84-b00f-0f08a5089c1d", "value": "T15CA69D03EC9519A9C1EAA231C9B69253BA717C495B3123C73F90F7382E77BD06AB4750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026429, "uuid": "25060b80-9ca0-40ed-9b18-a5f92656709f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026429, "uuid": "24dc6ab1-fed7-40c8-94a0-c8d97c258f97", "value": "98304:1cKT5FisDYaUAy28DkSEkPETXpBEY6zVumJ5VmCWgGdwzpwY21iV:1cKDiaYaRF/mEjogamCbGqzb4iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026429, "uuid": "91610555-a7ba-473b-a4ae-054bc26bf95b", "value": 9639424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026429, "uuid": "7d6ef68c-0819-4a24-8a61-aefe721c9c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026429, "uuid": "d3651642-0054-4659-9fa0-179bb1f5feae", "value": "osamabinladenclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34ee312-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022687, "uuid": "92f68e18-ae93-4dbd-9b5b-782ba1c05e02", "comment": "Malware payload (Mirai)", "value": "d6ffb174ce87f69e3ae9ddfc5e4c6cb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022687, "uuid": "86bfd72c-c39f-4481-9e45-910a9832e650", "comment": "Malware payload (Mirai)", "value": "ac914fe1b0ce527bb7f29f31bde365151a6fb65729e5980ff38b085b579bc457", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022687, "uuid": "b24d7ead-8dcf-4590-bf86-538f5b910f61", "comment": "Malware payload (Mirai)", "value": "714841522c5e0bdcafe725c0dce4f3922a3a7976", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022687, "uuid": "650bf072-51fe-450b-b12f-6f2152a839f6", "comment": "Malware payload (Mirai)", "value": "d0bc64ac9d79e6c27a5e4dd8f3067bfffa3db6f48956f67626267ba87784193dc08fc8ecab8b788ed58b6be6f3b7bcb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022687, "uuid": "e117d996-3df2-4221-919e-c992ed633817", "value": "T186A2D0684B024AFEF6F294340FD993987D740B22AB42DC1B611DF5938E476687493ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022687, "uuid": "75a8a415-1479-4c3b-b4d9-8c5a8662ef02", "value": "384:/fwatoD+fGZv6K58SnGgdDb7eIIiSPSkdNLciNQXXe793MdVR8JgGlzDpH7uNj1W:/DtvGFh5NGgdz3cPtGiN+O+dcJgGlzDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022687, "uuid": "1568faa4-87f5-466b-81b3-e9b8a54033c3", "value": 23348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022687, "uuid": "798bbedc-d851-4b99-a904-c95cd6858c2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022687, "uuid": "e93cdbd1-9a84-4ce4-b644-4a04d38facd4", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab449c7-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053597, "uuid": "e878ec76-fc64-4882-b35f-20b990049a73", "comment": "Malware payload (Mirai)", "value": "794db95d2a8c3cb5b24a82b615902d21", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053597, "uuid": "c1a1f9d3-5e00-4b96-8714-62f274ce7053", "comment": "Malware payload (Mirai)", "value": "acc5780bade13667b2f6a3b428046546e950a45bc0226bf771382e5f8bc696fb", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053597, "uuid": "88f099bc-751a-4400-80da-51af51162265", "comment": "Malware payload (Mirai)", "value": "2b803945617d20a7cea140ac3a54bd3f1fec5f6b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053597, "uuid": "e1845fa1-149c-4eb8-b9be-c08a20dacd85", "comment": "Malware payload (Mirai)", "value": "25889c0f3adea87fa0b8154562229207956bece9144377803a1e7076f59cc5d2cee09c0e17ce5e2b8209359bbf5c2654", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053597, "uuid": "2a33d650-5247-493f-bea7-05f06c86fc31", "value": "T1B55302415AADE83ECDE2D5380B6800E646D849B4A482501E93CE7DF8CA07D64EBED5DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053597, "uuid": "a3c4f517-8885-4db3-9557-83256ba2cf58", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uVt8AQb:MaHJgMo8FwOA4zUFGUO3UhAV1Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053597, "uuid": "e4af104d-bb42-4dba-95ee-be73c5974e40", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053597, "uuid": "a66fcd76-ead4-43bd-92f9-ae22fc84b5cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053597, "uuid": "1633f9fb-bc40-420a-9112-ceb35ac5c569", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9ff74e-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060796, "uuid": "7900faef-60d0-4a8b-a7f9-872c8ce0bf8f", "comment": "Malware payload (XenoRAT)", "value": "71bae7a2c3f977ecae5fe96392f10a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060796, "uuid": "c3758b27-0db6-4a53-8143-c62720c5912d", "comment": "Malware payload (XenoRAT)", "value": "acd0089a83a0d081682f6cae177c713cb85cc9cda87969dfd0c21bd5a94ddd44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060796, "uuid": "52449b53-25ec-454e-a82b-6ffae1e2604b", "comment": "Malware payload (XenoRAT)", "value": "2b3bcc1d47183ae9ee4aabb706185334b8a23f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060796, "uuid": "b307dadc-8bae-4e2c-8beb-d67021dd1e32", "comment": "Malware payload (XenoRAT)", "value": "aa95aa63b5e4a40463e10eb82107e9d766b0bcfe412a6f0bf5ed18252949c03bd10a708220080f5e4bb5187ae13c63d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060796, "uuid": "297e11cd-6f9d-4fc1-b1e8-cfebc4b5c9b5", "value": "T1BC23F84C57AC8923E6AF1ABD98324263C7B3E3669532E38F08CCD4E9379339555053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060796, "uuid": "99196262-5667-4cbd-b367-66aa92ba5643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060796, "uuid": "07b2cde3-b597-41d3-ac01-4d577e155fd7", "value": "768:RdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5U:Pw+jjgn3H9XqcnW85SbTAWIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060796, "uuid": "2d23b18a-75e6-425c-b20c-503f3b21a2f1", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060796, "uuid": "b5199ea5-0306-4b34-ad71-3c8930e13261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060796, "uuid": "1404a998-319b-4328-a3fb-27dd91f0d8ea", "value": "XENO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcdf861-2da3-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1775031644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031644, "uuid": "0cdf7621-7cf9-4a63-b19e-ed8ee0f64593", "comment": "Malware payload (HijackLoader)", "value": "68fab3883cc29fbaaad774f3c5a32bf5", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031644, "uuid": "16023822-fa37-465c-9556-ac62e99e271a", "comment": "Malware payload (HijackLoader)", "value": "ace23351634f9b816b0c7aeacedaa41fc0e8d1bdd7b98ca4830782453ff34b3c", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031644, "uuid": "9c6775d2-8db2-483a-ae58-b56610e7dcf0", "comment": "Malware payload (HijackLoader)", "value": "2d64516a90a14f4b506abf51fb47964605c605ca", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031644, "uuid": "ca0205f1-e6ba-4f0c-ba49-30375b0dbf0e", "comment": "Malware payload (HijackLoader)", "value": "5f72b1670d4caf377f258717fc0a7926b0f7f0a9e9c52e3de0ce57ada2566059ab3899b4a720cbdbf647fed0f058b2e9", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031644, "uuid": "808d2e7f-5600-4d65-b126-5782d25bf315", "value": "T13396337E6A6A8723C12F4CB814530D56B93C8C05237BC9EBC265700B2B7B5E69F9570E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031644, "uuid": "e3bef6cf-28d4-43a7-b538-8e95260ed074", "value": "98304:D5kHTrm2infg+xeczdTJIDdy686HARLDCTMU7yN2m8uGhrcrKv10OtXDXtmh6tHB:lqEJJDySjPgJuzmtXhYgwdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775031644, "uuid": "b74f8797-ec30-44be-8df2-ebe258e8e360", "value": 9314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775031644, "uuid": "7cf8689f-2889-42ff-a14e-ee573e92a869", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031644, "uuid": "015ee07b-db38-44ba-993f-790cca3197da", "value": "WHKHPGPL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e97b6c-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775057956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057956, "uuid": "ed5e0555-1fa0-4142-b274-345a413af8cd", "comment": "Malware payload (Vidar)", "value": "e39421c7d4ae6091f650e1ad9292194a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057956, "uuid": "cee2b848-ce59-422f-9d1e-2089111023ff", "comment": "Malware payload (Vidar)", "value": "ade17539b21bee05bb8054d36a43fd70b05f79a9de3b6fdf24312f5bb65ac891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057956, "uuid": "dd5920f8-f4fd-44e9-8419-d0584db4eca8", "comment": "Malware payload (Vidar)", "value": "5d866f34902178247f79355dc5e8e66a2dfcf969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057956, "uuid": "92e593f4-087e-4633-8f9c-888067a1f102", "comment": "Malware payload (Vidar)", "value": "4493e845d2131ddc3ee3ba823b734ca7733e146dc550e55dd01fd3efc248dfa8cf376e659471e0c7388a10d65a3642c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057956, "uuid": "6e21436f-3dbb-4d5d-9bba-72661e016ec8", "value": "T108B57C0B6CE448FAC0A9A33588B652927B74FC490F3267C72E91B7792F726D09D35B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057956, "uuid": "8dac14cf-907d-4e44-aa2d-e762e5aa1e99", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057956, "uuid": "8331e840-a83e-4738-98c1-ff74951703d6", "value": "24576:E93+fBUXwIGVXyGEHN7dRC6PqwOWBpe/5uTmTkiu4dlbK4K+hGV4UqiBelety9Dd:E9m+glXyGgN7SK/UTxzum7RaVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057956, "uuid": "d31c6f1f-624b-4cdc-8000-2c6de92ed79e", "value": 2475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057956, "uuid": "15adc43a-5e19-4d1e-b4ea-b8cd0260a1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057956, "uuid": "44bb6a57-8095-481e-9dca-40378fe9f8b1", "value": "78d37064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2e2d12-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775057408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057408, "uuid": "a21151f6-0a0a-490a-a978-7a19586f43d2", "comment": "Malware payload (VIPKeylogger)", "value": "220436e5e3f5ac997870f1a053b73fe8", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057408, "uuid": "02359c99-e964-4306-bf78-7f1c0b370ff3", "comment": "Malware payload (VIPKeylogger)", "value": "ae6918bfe8774e1ec1ec34f3db26e7e548dd0dc33a4e6fa80970e0bd2ba7ad9d", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057408, "uuid": "f0036d23-c397-47f9-9f99-fd25011d6a4c", "comment": "Malware payload (VIPKeylogger)", "value": "2e5ecda4831e5ed9c2aff76284b3838bbbd211d1", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057408, "uuid": "7a975e4e-61fe-4d31-8e59-28128a3698fb", "comment": "Malware payload (VIPKeylogger)", "value": "ac7a041d8817b2659952fb6d12126154aeb8869456abc194b3a1796eea0b5be27f2ff6116eb254a4b9897a006360e3cd", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057408, "uuid": "49c01dfa-6b2a-4a88-8a13-6f85f7dc7d5b", "value": "T114E36C60DE24027A4F476B9CFCA50661CABDC319453644B0F5DE870D520A9ECF3BDAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057408, "uuid": "6eb238e3-bbb3-4d52-833c-5122ffe220a0", "value": "3072:dtM4Igg2zRGFGRG2VGlGIGAGPaGCGUK+gk9rxrVW2H+XGv2XNP9HkCYkJB9o54WM:dtZIgg2zRGFGRG2VGlGIGAGPaGCGUKvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057408, "uuid": "c024f105-52e1-419b-b7d0-858c02524974", "value": 145016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057408, "uuid": "f6723b78-ce59-4f20-87ef-f9b47af61f54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057408, "uuid": "1eff59fd-ebed-4268-b32d-6462c83953bb", "value": "FEDEX88923953028MSCVGO00208.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe1bf6c-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022682, "uuid": "f2d96d9b-23d5-4f3f-b74f-13419c14dff0", "comment": "Malware payload (Mirai)", "value": "5a594fe80df6419fa8efb231c753361a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022682, "uuid": "d0a02f32-767e-4b1c-a2bf-bbf8e65735a9", "comment": "Malware payload (Mirai)", "value": "aed989d84071a05da9662f9b1de8d36973fdebcc641e9e9001c341dd899eebdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022682, "uuid": "f3f5517f-0a3c-4ea9-80c4-ae0577577565", "comment": "Malware payload (Mirai)", "value": "3d835b47d92183bd12ab4ebd59f96d86d5e4bcf9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022682, "uuid": "852b39e2-56ef-4953-bea7-318f9b79020f", "comment": "Malware payload (Mirai)", "value": "7a3fee920bb516876b01862609cbd36a7d9b1020471f6f230899131807f2eea3d4025951cb9c42a5cfd6c405aa602d81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022682, "uuid": "bd01688d-c700-4f38-b491-ebd8d1274276", "value": "T11192E191F6FF2B82E964A1BB0E7CE0530795D0012BE44BE27901464FBD2B9157040EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022682, "uuid": "35fbd647-9e81-4dcd-bf4f-b6d27d4d1287", "value": "384:M++qhGIvpvIZBHUwFZQkp9ZWCrqenB+H53X6cgSPYSyn:jPhvYHtFZQWZRrd+KcgQ0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022682, "uuid": "9387c43c-40c1-4708-a22c-2908bb2c39e5", "value": 20904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022682, "uuid": "ea5454ff-5d0d-46cc-957d-241cf895dd41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022682, "uuid": "926cd097-8cdb-47e8-8f51-9c28c71d2709", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b9d54a-2de1-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775058385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058385, "uuid": "fd2b4ca4-cbb2-4c1e-8937-e7dd0a79c8ee", "comment": "Malware payload (XenoRAT)", "value": "ba952bfc5cf3b9fed3bed4ef4de2de0d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058385, "uuid": "86c37d20-cd97-4079-9031-bba946691995", "comment": "Malware payload (XenoRAT)", "value": "af01f0ae6654c8094fa97c558794e132c70c21ae8bc720ff7dd4ddcc2e0d3429", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058385, "uuid": "8f0c4cde-16b3-4497-a51e-83b69f73fa94", "comment": "Malware payload (XenoRAT)", "value": "93244351ead25a31445d99e8fa594b49a2594b95", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058385, "uuid": "422dbb0a-c09b-4a11-8108-285fe14fecc3", "comment": "Malware payload (XenoRAT)", "value": "96b66202321f661b74dc3800061ea1be61df61c02b23caca612b02b261a87b502e7e8e458989e9647791f4ea371a25d6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058385, "uuid": "6e3bc9f7-5875-44f4-99f3-6f0a5f939225", "value": "T1EFE3E032DE108CC009F0F252FC4B28CA735DD9D78BA9C9DF656588B25EAD27BC604D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058385, "uuid": "fea233b0-0aea-4964-8f35-21b12c60ebfd", "value": "3072:6wXkcxieXZLaouC3l0TQ01WQvuju/KFH7um964CxVaziO0JA:6wTx3U1QQNuju0QDHazis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775058385, "uuid": "0459deff-865c-4aec-9fe2-cb672c786ab6", "value": 147338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775058385, "uuid": "d774e040-d471-4886-9fb5-78303aee8552", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058385, "uuid": "382116ba-8f1b-4507-b66b-f3316a9b5065", "value": "2222.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc3835a-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060766, "uuid": "dc1d416d-ad17-4829-9c4f-6700f0d5745d", "comment": "Malware payload (XenoRAT)", "value": "e944892e88bf4a00f37d3ff997e80a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060766, "uuid": "f06e55a7-0b4c-4333-a8cf-ccb5960af7b9", "comment": "Malware payload (XenoRAT)", "value": "b0579da603a03eba258761b8f49653db144c2c7ec6b13e5a399ba8d7487167aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060766, "uuid": "ab08cd60-8dd3-4dbe-96bd-858150575a6a", "comment": "Malware payload (XenoRAT)", "value": "ca26b7aea3f9332085a1299480227e7cf062f1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060766, "uuid": "23e5dab3-aac3-4da1-8500-37f4edf9d3a5", "comment": "Malware payload (XenoRAT)", "value": "081fecd2f8d47a38eb8386c703b6d4064fc321d781a63a7a5d6586297d55183a423759dd59dbb4dcd192287d2be5a73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060766, "uuid": "259e917a-13cf-4c0a-a253-01f9ad86a98a", "value": "T10DB30B6BF6C49707C949C5388D27807A66E3651E12E3F226006B6CED3DF23F9674721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060766, "uuid": "bbe049f5-fde7-40c6-b80e-d2913210cee2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060766, "uuid": "0c2b5c67-d310-46c8-a993-51c9188386de", "value": "768:bdhO/poiiUcjlJIny9SH9Xqk5nWEZ5SbTDabuI7CPW5iZ/YJ:Jw+jjgnyoH9XqcnW85SbTOuIuYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060766, "uuid": "2f61aaa3-e1fa-47bd-8db0-128a743a91b7", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060766, "uuid": "3a67c237-0073-4806-93de-214b6f503f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060766, "uuid": "03f752f3-9b10-4cd8-abbf-6785daa517e4", "value": "Chocosploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70981119-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040131, "uuid": "038a5a9a-2342-4068-b20a-a21a3e905921", "comment": "Malware payload", "value": "4f5a4b416eb2690e1f0c3ce4efdcbd05", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040131, "uuid": "41cdcf10-5a9b-47ac-b82d-bf0e54957f9c", "comment": "Malware payload", "value": "b0847d54bcb077c51e83f03e82f61063ce76325b3467cbb1dcf90eb076a3787e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040131, "uuid": "392770ea-a491-4456-b535-dfefeff9ce8a", "comment": "Malware payload", "value": "0a25acea43f389f9d3348e0410217ca3124cf8d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040131, "uuid": "560cf393-c5d0-4123-8b79-719b7a1b4918", "comment": "Malware payload", "value": "af66d5347019cb2c093a798667ead711cd8282f9310d1379278e0642b9bf4c5d03c7f3d6cb8e9cbed2f426e754eecd2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040131, "uuid": "07196d68-51fe-4b58-8c2e-7b8f1a8db907", "value": "T123C633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040131, "uuid": "67e70c1c-0094-4a70-9e71-4d8ad11738ae", "value": "49152:p6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOc3:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040131, "uuid": "aae90d8a-305a-47ee-9167-0c4070466410", "value": 12190305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040131, "uuid": "085aaefa-4970-47fc-839b-d892eeb5646e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040131, "uuid": "9b950187-68ea-4637-a1ad-af180883edf5", "value": "b0847d54bcb077c51e83f03e82f61063ce76325b3467cbb1dcf90eb076a3787e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861b232c-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775057777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057777, "uuid": "c7c8b861-37c5-476a-a0c7-504829a3a027", "comment": "Malware payload (PhantomStealer)", "value": "2823d06e4ac82e308fa2721309848a6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057777, "uuid": "18b227b3-e4c0-4fdc-b871-446bc3a74bd6", "comment": "Malware payload (PhantomStealer)", "value": "b08f6f9e3d05ed5ad0e36fcef2b9d7f01a168bb8f46ddd90ef2d1f5aa69c11d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057777, "uuid": "ac9cce96-0b2b-4647-9d42-f8496e7ef216", "comment": "Malware payload (PhantomStealer)", "value": "caa9aefe6e4781c69eafce2be8b0982987e1b0b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057777, "uuid": "3feb3e38-3fe8-4955-8a1e-90f2407f6e58", "comment": "Malware payload (PhantomStealer)", "value": "a6077001916dfdb2fb0e312889a03cf2fc72be04554d0ce0bb584997b242892f14f291126738b075f4cd7957dbc8318d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057777, "uuid": "94363c93-407f-45f8-9a29-b2cf8b792da4", "value": "T1B526021189C46FB9CFAC5A1C80FD160E93F04B8E541A798EEB33BD46AFE7944520B19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057777, "uuid": "fbc2a2eb-9968-44aa-9c72-efadc7bb99e0", "value": "49152:7Mb1BAWCzV/UuRhqroY+tioc6AZQ4ZvPLKmZUb7TasACmDo2zwm12t13F7C:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057777, "uuid": "26092457-a170-4e39-a5e3-05e2adc3197b", "value": 4743135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057777, "uuid": "82f926b4-c50c-4ba6-9452-76a25b527a39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057777, "uuid": "3c51b10f-8ad0-44b9-b625-0464df98d653", "value": "startup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c827a16e-2def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775064330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064330, "uuid": "62eb4024-b4db-4530-87aa-6547c88a5ad0", "comment": "Malware payload", "value": "1407a9f096d7c135b546d53c6c263c2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064330, "uuid": "f91fcb3c-bbbd-4953-92ef-e4ed669fed45", "comment": "Malware payload", "value": "b0e20b5136c9d7ee37bb7c9e044e46f4a29049038ec3543156c1e84c7bd6f062", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064330, "uuid": "3ac7cdc3-fbe4-441f-898e-9b9cd3bdaab4", "comment": "Malware payload", "value": "b4768ba940646c24089ffc39be4302422953f085", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775064330, "uuid": "1fbcbb9b-bdd0-43df-8f4e-f07d2dd70eaa", "comment": "Malware payload", "value": "6ec07f7e7c9f4b64616cc06806acefe12aa722237a2a07b0553520b8c05ee31b9370e4dcc5ceac36394e5d87790b5e25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064330, "uuid": "c76de2c9-0e02-4a44-8c1f-84fca2148333", "value": "T1E06332F0CEDD44D415C37C08A9EE627F7847E082B818376ADC8A56BEE24C65907D93B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064330, "uuid": "09c50975-a685-40b5-8eb7-c76bd8b11391", "value": "1536:9DY1W7hRgiED0sUPoFm7942OkRWvEzu++xXXzNeN7IwIoCgy22Kfud4dDAV:9DY1W7hRgiED0sUPoFm7942OkRWvEzuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775064330, "uuid": "c14a0ad6-d246-49c3-9cd0-0268edd90361", "value": 67894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775064330, "uuid": "e1b986ce-c417-4339-9011-927484fc1bf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775064330, "uuid": "5351fe17-5f56-44b2-812f-fe88b74e5045", "value": "3license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed926ae3-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775041200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041200, "uuid": "b16726c6-47bd-4d84-84c7-8c8060a17351", "comment": "Malware payload (LummaStealer)", "value": "f8b7dd33f333f170c5d68a6f492c1f88", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041200, "uuid": "91a7144b-4aef-495b-8534-4c9137c97a18", "comment": "Malware payload (LummaStealer)", "value": "b2419d5fac72ce685db92544be9410962e22aba6326486f586b7eb36a3bb9bb4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041200, "uuid": "329fe3b7-3106-445b-a65a-4eba64df8c38", "comment": "Malware payload (LummaStealer)", "value": "7bcd7ae3a22953524fc22fb867921850460a43fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041200, "uuid": "3558da26-af10-4f14-88ee-0d4556963b9d", "comment": "Malware payload (LummaStealer)", "value": "0a6a31fe5f88d8258ff01d1831a094bebe3b7e71b6e920f45723fde633e050deabe6e1503a4bb8974e8f039cf47ce808", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041200, "uuid": "f8baa461-be31-4601-af9a-1aff28f3fa5b", "value": "T13E655B40EDC749F6E41617324AF722AF373A99090F329B83EA40B779FA761D11836356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041200, "uuid": "3458eb8c-3342-4781-88c4-2d243f34287d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041200, "uuid": "a8ee8327-5ed9-4b7a-a1fd-94a17230089d", "value": "24576:7SGJfepQcmQvLo9LPcfxdBI3pZvIOOIajmDzPjzA/B72kutL4cVCp+0aSBM1xeow:7Vc4gZDqkQJ8EC7kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041200, "uuid": "cafe856f-5bfd-47c6-ac18-c299ff573bf4", "value": 1484928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041200, "uuid": "50d4b02e-3b37-41dc-8ac5-f8c1e850703c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041200, "uuid": "a326e3e9-5c9e-4191-9b2a-d3dce5034620", "value": "nlGrBTuZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5992def2-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053836, "uuid": "4d707a81-9ceb-4039-9fac-7fda5c96e453", "comment": "Malware payload", "value": "1d34aec73c2f73430cebf6e26322c661", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053836, "uuid": "26cdb3f3-3e1b-432c-8d63-3439587e15df", "comment": "Malware payload", "value": "b3f5cb7ac337f6343e1fc9c1c1357cb1183f404ce03faf774014f2a3e21c358d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053836, "uuid": "18094e1a-021b-44ed-91b3-b326b954b13c", "comment": "Malware payload", "value": "221d7d931c38e87492881f8cc976ba4ff2c04f64", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053836, "uuid": "0710044c-fc34-4d4a-af51-6f0d0541d74c", "comment": "Malware payload", "value": "bed4b899be9b33ca3caef18f4adb4a1e5eb93377e6d6496b3b1d174bf52fc40a173f396a0608cd9fb932388d2697e782", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053836, "uuid": "c12b983e-6b14-4e9c-aed6-06eda4869ff2", "value": "T16931B501EE54823AC94E6D3501AD6AB7190E7E43894C8892602836D60DE5FAFFF76707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053836, "uuid": "42ca9e3f-f484-46d3-a716-7aaba3977478", "value": "24:98sbpHQK0yXbCC88GHSp5Vg9jWyI5Y7dO5i9F4FHpBhHb+1:98sX/bC785Vg9m5OMQWFHpBhH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053836, "uuid": "04e4bf60-bb4c-46d1-916b-9d9a6cb37133", "value": 1578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053836, "uuid": "684f6afe-ff9a-4ff3-abac-e58828534d16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053836, "uuid": "49e65cbc-3b27-4d95-a5a7-b83804abaac0", "value": "Social-Security-Statement_04012026_d706db03.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1037e4-2db0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775037090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037090, "uuid": "0205158d-f394-4cc8-84a5-2c7e8bef9577", "comment": "Malware payload (Mirai)", "value": "26dbd3b125e7ce3c237367eb42ece5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037090, "uuid": "57fa885d-a8cf-433e-872a-875880fdca82", "comment": "Malware payload (Mirai)", "value": "b4c161f183d40a4e9908901e3519f2100a2cf14c19bbd5344ee8de5720f5790b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037090, "uuid": "0dc83ea0-06f8-44a2-b5a8-b23206d688a7", "comment": "Malware payload (Mirai)", "value": "ffd087a71ccbd0da4414eee81b64017e5cf831ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037090, "uuid": "2e12cba0-6a6e-4494-85f4-eb079505c6b7", "comment": "Malware payload (Mirai)", "value": "afd1a3650d874ac6d540a7fc7fa67c271dbb197a450f23249bc3ab2416338ee20c05ae2febd82cfd0a4df300984d983f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037090, "uuid": "0af6dbd7-ab7e-42b6-bc4d-0281152ccc5e", "value": "T1966301A4C311D9CBCFDB6DF40E04B7F1A2326D0996722AD3A77883906BD7E0A5249DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037090, "uuid": "2c868458-ef51-40b8-871d-53fc2d58376a", "value": "1536:VjT9TY4ATMQiJ9LEf2q33MSwnI/FPZ7TKMMkqsLfZCklt4u+qgw09U:HY4bLPLEf933Dt/RZ7TNZT4u+qgwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037090, "uuid": "e235b8fd-567a-4f68-a4b2-fecdd1caf6c9", "value": 67684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037090, "uuid": "1a6397f9-f190-4ac9-952d-7f2538b5dc1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037090, "uuid": "98e46463-bf8b-40ae-af3e-e14f033a766a", "value": "kurayami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8040fec-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039499, "uuid": "bf8e89db-4544-498b-9df9-4e1cff682d4d", "comment": "Malware payload", "value": "eb7635f4836c9e0aa4c315b18b051cb5", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039499, "uuid": "13c9dda7-3421-4760-b3eb-3aa8e2fdda83", "comment": "Malware payload", "value": "b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080d", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039499, "uuid": "7a020f56-b09e-40a2-962b-570b719573d3", "comment": "Malware payload", "value": "b185d3822ed9c4f1ede49ae4ddf5b22bd911b1e6", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039499, "uuid": "fc30019e-4c93-4e8d-8584-cb44c1741251", "comment": "Malware payload", "value": "dedc408279c6f58a9fc5f679b3d221768a47767ff22416fd162814578f12abb99176d793168c9c09a1f6612c8905ced7", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "UNC1069", "colour": "#5D0232", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039499, "uuid": "0ad9b06f-5c71-4907-893f-25fedecd6fef", "value": "T15826221656DA92ECD0C3CB7076C753CEB0E4724641FE992A39CF2C03BA61D5A458FA72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039499, "uuid": "d00072a0-bd71-4af1-b19d-1c72c32cc0ad", "value": "98304:QSHP9xWC/CbcbDMzUkTwmJu5Va4a7xdpj2n8+0hg0:tFLC4PMIkTWg4abd28h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039499, "uuid": "abb90537-4d8e-44a4-9348-30483902a458", "value": 4527752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039499, "uuid": "0bf5677d-f052-46f0-91ca-3ef7a9a96c60", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039499, "uuid": "ab2f8f37-276c-4a37-8efb-e3ab364fa1ee", "value": "b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b349566c-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775038525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038525, "uuid": "147e581b-5a55-48d9-bfa0-d509f633e350", "comment": "Malware payload (Mirai)", "value": "31a0e2e5b1df12f4d77c6a1c2a14c570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038525, "uuid": "b89dc580-8695-49ae-9360-90a38047c3a5", "comment": "Malware payload (Mirai)", "value": "b5466c8d11f631841ea3ee55c504c07bf759508bbd56cef9bb49987452c0559f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038525, "uuid": "35bb489f-5a10-4d56-ba12-8299bb795ad4", "comment": "Malware payload (Mirai)", "value": "e63f7c28f14e4f1b61e63fec81278a8a7d0f1926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038525, "uuid": "f8d164e2-3c4f-4a09-9f19-94621faf6021", "comment": "Malware payload (Mirai)", "value": "8696fb250dc007c4705494919810f9a6f8e71feab9fb61f15a20585ce358c923aadc0358c10ed19a7a2ce7995fda2db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038525, "uuid": "79707d34-2a4c-447e-b2d3-1d2b5239ce38", "value": "T139831B82BCD2951AC6D4277EA62E719D3361A3E0C2CB3513DCA74B15378729B0F27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038525, "uuid": "2f2d3091-6bbc-4d6c-b14e-0e8d8ce2e53a", "value": "1536:K4MlK1EKuGZDErmKuehgWr/iFZkcP92RolA8D/DO27jrYp:K4MlK+KuGKrGWbiFV21ar7jkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038525, "uuid": "c5c401a3-f951-414d-9473-00d14764a03b", "value": 84440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038525, "uuid": "367ec1cc-59d1-4734-aa31-e89d0f71136a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038525, "uuid": "35f2abf1-b47d-428d-9412-be3922a0e6a6", "value": "kurayami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d2c4d5-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "7060ff70-dd2b-47be-b4e8-304dbefcb48d", "comment": "Malware payload", "value": "7a160e20c51755b20fd3147c5bd1a7c7", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "98e3c7d5-3dab-4649-ac02-4b4a090d56e8", "comment": "Malware payload", "value": "b56e1ebd367b0fd66122fd1ff7454f41e23987b143f00340ebc81a73357cf96f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "4166a92a-9582-42f4-9fb0-643e8b4c6273", "comment": "Malware payload", "value": "6534d5d9f97ecb2925905bc536f7466a02f28281", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053594, "uuid": "159cf751-6857-4f8a-8858-44a977cda642", "comment": "Malware payload", "value": "da8093969af623747fd6830a1aafc29a3807a80216bf0fa05e8430008dd899ae26b84afff1966d92106042e4988c3946", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "371b45d9-b544-4442-92c9-7125515f1532", "value": "T1DBC26C047BE8CA6AD5BE4774DC33530483F6FA11A632EB9F1580941F1D73781A922B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "c3937e6a-5ea9-4a8b-aed1-62a1a0420e58", "value": "81eadede6a9ee449b0ee858128bdbb74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "73c9d8aa-5f76-445b-9bfd-c520ade051c1", "value": "384:6hXLlsiNJhQ/OLHlp9o4O20ave5OlrCLF2mDmwkAKXTJMBmdYKx:wNM2zljmucfLhDXoNMBwYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053594, "uuid": "970a92f3-bd70-4b39-bf60-8116eacf2de8", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053594, "uuid": "fe648ccf-81b3-45ad-b3bf-9afc34af7739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053594, "uuid": "0333ebe7-8fbf-4325-aefa-5739ac784996", "value": "appvisvsubsystems64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60257b38-2dd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775051270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051270, "uuid": "304f9488-7e86-46a8-ae88-631349362335", "comment": "Malware payload", "value": "c3125b3aa095ff7cb5fc4f9b83a3a9ef", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051270, "uuid": "ba1584e4-3b93-4abd-9a03-9fc7a1602a03", "comment": "Malware payload", "value": "b68e729104d051eaf3d118f9fd9c3fde81255f2b14f349a9ce421423407e5a77", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051270, "uuid": "92990e8d-b8dd-48c2-8878-52548b7e6e46", "comment": "Malware payload", "value": "abf91bec048335328e2d77e07baa35e8de8b186e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775051270, "uuid": "ab80e4af-7fc9-4db1-9a3c-e809734ba8b2", "comment": "Malware payload", "value": "73283f85f8b036ba5afc00a7ed7f9ed673a34a94bf159bc00ea94dbb096be53ea0cf148fbccb9c55051fe5d8387acea1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051270, "uuid": "c2ca9f97-f8fb-44b7-a5d6-bf8ca80e7a85", "value": "T18572F43824324A47DD226285182FF41E2AF3F64FB4D8C8F15677C3B7E272B496246679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051270, "uuid": "c8bcd44b-d1fb-40cf-a811-f3ac6d5e109a", "value": "192:G8U6fN8eXiY2rN7vQthf6phgN3b3iQDyJcLZ:V7fulY2rN7vQtV6ngN3T9LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775051270, "uuid": "3e12bb3b-8fc5-472e-ad14-a04c762e2ba3", "value": 16889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775051270, "uuid": "d463eb3e-cad1-4bf4-9860-c57dfff834aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775051270, "uuid": "ff7195e4-50a7-438b-8045-dbda19fb6101", "value": "c9.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9be8c3-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080846, "uuid": "d6808718-251a-4b0f-ad01-f75340c21bc3", "comment": "Malware payload (Mirai)", "value": "0127028501f1a927b49c5c394f597af0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080846, "uuid": "4dcdf677-299e-4456-87dd-8f6c2877fd2a", "comment": "Malware payload (Mirai)", "value": "b6e50222ea2cecfbafccd6ec4208cc444f82db9d4dadaed6e5cb7302a690cb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080846, "uuid": "204a319a-db36-4830-a4c9-edf322dab069", "comment": "Malware payload (Mirai)", "value": "c1605015a8188c66aeb7fd4a411c0d67442aa76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080846, "uuid": "bd5d860b-856d-420d-bed9-8241730e9657", "comment": "Malware payload (Mirai)", "value": "1ce2f484ba2df3a47fcded2582dc8b05ddeead39ead7b3173c1a80391341489db5eac1a1d44e7e86fcc0fcf8645fcd5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080846, "uuid": "40132818-2ebc-402c-b3b0-14574e97edc8", "value": "T1C1F218127ABA1B17C0D2293920AB5F9236651BC963C4D64FBE72095FBDB23002D17EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080846, "uuid": "5f56204a-fd1c-4998-bc70-3739892cc69a", "value": "384:+WUJJlBEiH2xWFnMRV3pWbDENXTebve/ZLZZgRqHd0S3knTtXhkFPwF2U:+WfyFFneTxVT11ZZcqHd1UnVhkFPwFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080846, "uuid": "d9a15b93-0978-412c-bba4-e01cfa8778df", "value": 34860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080846, "uuid": "12017dd7-a2d0-4884-92e9-1ec56e64b906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080846, "uuid": "fa473b80-1cde-47e6-bdfe-7e0ad226db16", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8232f6ef-2dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775063783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063783, "uuid": "05c3712a-fdb2-4d0f-8bee-584b9c450745", "comment": "Malware payload", "value": "e37bb0fbad549f966126722fd59b5ee8", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063783, "uuid": "180f405d-e2b6-4dcd-b1fd-c8510d369bc7", "comment": "Malware payload", "value": "b7077463eec3d4107f1fcaa7a00847f0921f38ce018221b553e06c1861458ee2", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063783, "uuid": "1de9f9a4-3a8d-4322-a012-9e8a0e841ead", "comment": "Malware payload", "value": "b14fdbee382f8246da8f6fc6e1267659c2c518c3", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775063783, "uuid": "e725b7f4-82e8-44fa-a81d-8257c2d0f1f5", "comment": "Malware payload", "value": "8caa037fc17de55dcb61df92ccab9210530c107bc1047bbeb91bc5a3c625ef57b9523b2dc4300d3030bba77789d87c60", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063783, "uuid": "a2fe521b-6718-4a27-ab6a-b7b9aac0bf51", "value": "T1ED4401BB9AC8BD7EC85C06F34953B4F0B2094D579574B12269039BCE8D8C90D42A69FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063783, "uuid": "8650a8b9-318d-4eeb-8de5-4a49b57d7eb3", "value": "6144:+XHxktl5lNXlEMsBkUK1pownvPo1zoHb5Tw+iSGSnGH6a7pQ:+hktl/NXlQBkUK1Dvgdo7tr3XG3NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775063783, "uuid": "1f1366b5-f3a2-48b8-a769-9b24769e8d0b", "value": 278393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775063783, "uuid": "cb08faec-9c93-4a9f-82b5-af89018921be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775063783, "uuid": "c30832fc-981e-4b86-a8fe-c09bfe80c1b6", "value": "b7077463eec3d4107f1fcaa7a00847f0921f38ce018221b553e06c1861458ee2.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e876cf-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041596, "uuid": "f3e1eb57-28e7-4fdc-a485-00fc63584e99", "comment": "Malware payload", "value": "4d6a1c841d772412a3a0bb595e602c82", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041596, "uuid": "58f71663-394d-4d5f-87d6-efd5bd3e1d2e", "comment": "Malware payload", "value": "b7d2a540e591492a71fa7921fdb692187d62ffe44e341114ad58105db6cf6d8b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041596, "uuid": "b608bf3f-1d83-4b1e-a97e-a7b0e253e55f", "comment": "Malware payload", "value": "3d2ed57ea65c948e5b0af170d926fce50b78ebee", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041596, "uuid": "3ef8c187-d09a-4f44-9a2e-5495d4627f1a", "comment": "Malware payload", "value": "59f55b7ce2d8b1e0d438eccdce6e4ca3b1c582cd99ae04d684dd9aa5c4a8f42523019f2cf03cc64619cf34be1eb3b40d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041596, "uuid": "a4724354-de20-4814-a28f-bdbfd8dabf49", "value": "T15FA19FEB12CAE742AF65AF8250BA4F8908F425D54E054E43ADF7624FB2C149AC4578F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041596, "uuid": "a4867f30-4d97-47ff-8862-1607472a7a5d", "value": "96:/VXf1TSt775TNGvaJsBpseuey6C5JbaEaSazxcFVZ5WlUWijwQMP9Zt:/bTSt77xR8pdvA1aEalNcXZYlURj6vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041596, "uuid": "08bcd1b4-05a1-43d4-8e84-9a4e0fb5eb77", "value": 4958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041596, "uuid": "d3687049-dd6c-4793-a3f6-b44d485332c4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041596, "uuid": "b4f8dabf-b29f-4ce4-a92f-6598f9d7c710", "value": "b7d2a540e591492a71fa7921fdb692187d62ffe44e341114ad58105db6cf6d8b.gzip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dee09f-2d93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775024723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024723, "uuid": "41fbf27c-bed3-43f8-b14a-10e8bfcaed6a", "comment": "Malware payload", "value": "1fc8d09a95056991bdeb00964dc7697e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024723, "uuid": "b560ffd2-13a9-4717-ab1f-115d84703849", "comment": "Malware payload", "value": "b8d2133fc3489790cece1d2b0509b68a498b9c7421ac7761b6f95fd7d5735fe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024723, "uuid": "0df85198-0f43-454a-b687-1d3cdf0ebecb", "comment": "Malware payload", "value": "c42bd04179a9a1dcee78d8b25c97b179adaf9e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024723, "uuid": "fbfe6569-e62a-4bbf-b12e-0c258abadb44", "comment": "Malware payload", "value": "a339c651f921a32223cd0b50660fe69cf3350639c7f86be9980287083b3788a69b3abaf9856b54e7ce03988d3444236a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024723, "uuid": "8332df83-f209-4f92-9dc3-eee2ad8060ee", "value": "T183B68D43E89515EAC1AAA331C9B29253BB717C495B3263D72B50F7382F77BC06AB5340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024723, "uuid": "e20419dd-4dbc-455a-843f-2fb8c853ca86", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024723, "uuid": "024b2207-3c12-4fcb-bcc7-fb0b9db7b56a", "value": "98304:BSgMAWdlU12qWvxAfLzE9+B0MnLeLSdmLRWcwxUdESCiF:BSgJWzU1C0g9unqBwxUdLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775024723, "uuid": "a392100c-b6e1-434e-9fea-64e1c5d16b9a", "value": 10547200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775024723, "uuid": "15da1948-5da8-47ab-95b6-4a433fea9cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024723, "uuid": "ec144f82-4d62-4aa0-8cba-853616afb0f4", "value": "1fc8d09a95056991bdeb00964dc7697e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2738f16e-2ddd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775056329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056329, "uuid": "33555504-e5ed-4595-8710-da805da77d88", "comment": "Malware payload", "value": "5080ff0f9f6b1950ce7d58fe0abb5421", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056329, "uuid": "59908fed-d1c5-43c0-a0d5-f5a96c3f5478", "comment": "Malware payload", "value": "b9368b7c946266b47ba1ef4096e9d1dc698321b5aff2f6fd3c07273b21b533de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056329, "uuid": "10210a98-59db-49e5-ba73-b0bc92cbd02a", "comment": "Malware payload", "value": "79637044a5184e36049fa1798b4ea9a2ce57a271", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056329, "uuid": "6adc8ead-c8f4-4952-830f-57db09c36d12", "comment": "Malware payload", "value": "860c1e8f3beb0aae1b92792aa2dce375fb18188a693e6318b4bcc1e1abadab002807e9e90498f599ed885643388b79df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056329, "uuid": "b6deb470-ca54-4086-a4fa-daf070f79d1b", "value": "T18854CE02E3FE6511F1F38F90BBBA78841CB97DA16D0DD5DC25444C8D0A71A8A89A377B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056329, "uuid": "05d992ff-8e73-46ed-80c8-f4c3cab30003", "value": "6144:xoO4KW6BoV8OVsyfFkkqSaHHLmUowgwn7cXd4QMd:WHcU87HHLa6qeQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056329, "uuid": "92407aae-4ce1-4ff2-84e5-746114d5005e", "value": 284332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056329, "uuid": "c3041a05-f4f6-4f70-8db6-3628ba8fac9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056329, "uuid": "5d0f8cae-d3d7-41b1-bb50-d5d9f957d838", "value": "Purchase Order -March -0065609036411154889000399553_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991c6aae-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775057808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057808, "uuid": "a85a43bf-b62f-46eb-a245-cd43b5e48c52", "comment": "Malware payload (AsyncRAT)", "value": "015ed9ba71f8e578b71f553ceefc85f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057808, "uuid": "0dd99824-2f35-4641-b2db-8811651fe14a", "comment": "Malware payload (AsyncRAT)", "value": "b954d66d6cb60a558efff4eb514a87f3ca4e657053090cc1d0770eb17e68560f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057808, "uuid": "c6f59a47-fe72-475c-b7a3-ed96b0f2a5e5", "comment": "Malware payload (AsyncRAT)", "value": "447de0687d12718fcddb23cfc3cf620af4d784a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057808, "uuid": "a2c15b37-cc53-432b-8bd8-81c1f18dd339", "comment": "Malware payload (AsyncRAT)", "value": "99326eb5a377be5602198e31b241778c62c78482f10e2bc4de044337a62dc31eae12d230fd64f5be9a3494694f94d135", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057808, "uuid": "56629a9b-d7f9-4888-934a-a5e614eed663", "value": "T1B9E550CFF46D07F9028B21E5C8963FA19ADB41F855392C0D2A886F6494C0DF23E55E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057808, "uuid": "2ebfee56-5e89-4255-9e19-103f6c6fd4a1", "value": "96:OPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMPCPMX:z3dj/lbbEqz4x1/atDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057808, "uuid": "4e29d442-5bde-44ad-8e9c-f5a1cc05189b", "value": 3033915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057808, "uuid": "a727a238-3f76-4c5f-8872-ecaecff80bf3", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057808, "uuid": "34a4a2bf-764f-4f6b-b249-932b2f328310", "value": "Comprobante de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fb68aa-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022699, "uuid": "58d12124-0090-4f3f-ac7f-e16129b26042", "comment": "Malware payload (Mirai)", "value": "112bd1294f032f69e706911d2d7484ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022699, "uuid": "112b2897-bd62-48a1-af4d-d8aa91ffcb8e", "comment": "Malware payload (Mirai)", "value": "b96b7e003ca1d93774cac5ba47add8b2246521a9456d62d4205750898ae785ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022699, "uuid": "60cf11d2-448d-41fc-9b10-30a75b5c485e", "comment": "Malware payload (Mirai)", "value": "24f27067b5151d2cb9debbc37d866b36501df849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022699, "uuid": "ce185420-8126-49e6-94f2-a3b17ec7fe2f", "comment": "Malware payload (Mirai)", "value": "86b119f7aa00a0118cbe04cd09dfc2cdf8ef31c11cf92600045e64f8de1d9700f8e3515a6f575b73c5c1585798699a07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022699, "uuid": "c225295f-4b50-4890-8335-d3a649475121", "value": "T1AD530895B8818E21C5D5027EF92D128E332227F9E3DFB2239E205F243BC652B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022699, "uuid": "4d938db5-10af-46a5-acd0-0fdb9081a069", "value": "1536:2UnI9VihF9S0hD9f704WifVePq6qiy/1LEn/MDiIDj95ID:E+F9ThD10vO0i/Dj95ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022699, "uuid": "15b21c9f-4b06-4cdc-b5d7-59a0ae4cf4bd", "value": 64392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022699, "uuid": "d43fd9f0-b836-46cc-be1f-b72064384b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022699, "uuid": "585883cf-8213-4c7b-8d7f-b25b17f711b8", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166428c4-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053294, "uuid": "cf11a692-d73a-4a8e-89f6-092cb482a3f5", "comment": "Malware payload (Mirai)", "value": "a0f26b9c23b0b16dcb2863f1e4fa81b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053294, "uuid": "1491d54e-68d2-4218-a3a8-4aefa5ea3a8b", "comment": "Malware payload (Mirai)", "value": "b9e9941cce29ab4e894e50ec4fab3a0563b8338499324bb49cec5906421ebff5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053294, "uuid": "e86af347-d669-4938-8241-55e95e02fd83", "comment": "Malware payload (Mirai)", "value": "bc6178950de77cd87f4829ca1c23c47bc7dcab1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053294, "uuid": "693eca82-e19e-47c4-8d6c-b2eb271736fe", "comment": "Malware payload (Mirai)", "value": "1759d6b9dc690288f0d6859e5bc23095c9bc5702ec2cdc97186a7f122f08397e90f828b976ad2098dfa1868fa8594422", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053294, "uuid": "1c435863-707f-4db3-b27e-4f44576c0968", "value": "T107132742B3180547D1631EB0353F47E1E7ABAE8122E4F288760F9B4DC171E77A942E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053294, "uuid": "c5504d51-a036-441f-bca2-1fece4d9f7ef", "value": "768:TuZQBal6xzFogyxBvDM2ccDP1UqI9XFPTMJy6/janpyvsM73V+Otauo:T0UFogW5DM23DyqWPwJy3nYx73V+uaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053294, "uuid": "5af60bf0-01ee-4b2c-bd64-e77b3324f045", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053294, "uuid": "1caf493a-3bda-4963-b10b-79654fcf79ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053294, "uuid": "be71e0f1-01ee-4159-8e2e-e6063d785238", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50358d1-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022663, "uuid": "68d47570-49ba-4d64-b96e-6db9bf500df6", "comment": "Malware payload (Mirai)", "value": "d3d90ecdfbcaff647bff92a53a877a07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022663, "uuid": "ffe29aaa-1dbf-4bf0-9a8d-bdcb0534050d", "comment": "Malware payload (Mirai)", "value": "ba4d2f103407816f75eb623830dd96d5bf1a368cfbdb47c604bb1f528c11e84d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022663, "uuid": "a2e20f9a-3dff-4f94-98bf-a6093bdcd0b6", "comment": "Malware payload (Mirai)", "value": "9593ee3ffdc0b916d5effd3de2d8ae5455eeaa74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022663, "uuid": "a986fb64-2a5d-46c0-93dc-69974cfbc57c", "comment": "Malware payload (Mirai)", "value": "c746412ec260523924dc00516a405747dd5294c3927f416bdcfc794f83a60c3ef131844894da3ff0bfcd29bc7a080cde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022663, "uuid": "c2b5fc46-2ef6-4af4-af8f-db79779fbe24", "value": "T169B2D0EEF1843887C46C4C75EA9E0BA25FE0325833EE5786A30418C4F5B6D96B89E574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022663, "uuid": "0469cbc1-c0e8-472a-92b0-1b73b2e2a8aa", "value": "384:ixY5KqbDmzg+Okt+a1/O7WEHQbVcQau6eGiKmx0f/3oTb02G3sbxcy/CJRWGVCzQ:i0xmzgmobHASFu/GiKY0non02GY3yWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022663, "uuid": "c2a10122-3dfb-442d-b14c-d24e92dad137", "value": 24420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022663, "uuid": "91a36d3b-ae9d-4897-99ed-8eeb7d4f4a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022663, "uuid": "ec4599c6-9a7d-4d80-bb92-b646559110b8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d63782-2de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775060459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060459, "uuid": "e5d647aa-376c-4368-99b8-e21cfa484b3b", "comment": "Malware payload", "value": "b075a5c7e457bda2c12882cbc371642b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060459, "uuid": "dfa7da19-56c7-49a1-8183-0062111eea1a", "comment": "Malware payload", "value": "bac07c354e37001f1f09f4d0fa791e178a0ff95030bbd9e1ccf732c263c9cdc5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060459, "uuid": "fa8cc0b5-cef2-48f8-8043-56f3f57ab75f", "comment": "Malware payload", "value": "220290984e26058eb0d82998f7d7a9c500d7c697", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060459, "uuid": "ece8957a-f584-4e12-ba29-0fdaa3464b65", "comment": "Malware payload", "value": "8d353afaf0bfe629fdb6764ca4e664e40c217e371c59fc5da77bd1f3d2370e639389a0dc02fdbf621d67e822ee6fb9c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060459, "uuid": "425e99ab-c38a-4759-b4f3-6d5c480fbe17", "value": "T1EC168D04E79406F4D177D634CA2E8332DAB0BC55A734D34F2559E65A2F73A908FAEB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060459, "uuid": "98d9508f-aa26-4e0b-982f-ad4683afa684", "value": "b1ebc8ec8a5b7eeed45f482c1fb251d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060459, "uuid": "165ad661-979c-4a52-b54e-5041fb250fca", "value": "49152:9+/HuQ48rsbmk/0S+RU4XG8svv48RBDdf+oMqD5xOesrl6g5xXjDPYyjvVUrnPv5:OLrpHRU41WDEFNrUrnP2URyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060459, "uuid": "9c3d647a-425d-45cc-9a59-57abfa7bcda5", "value": 4409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060459, "uuid": "10d13ab9-5a42-4c38-80ce-ca416efa2981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060459, "uuid": "53791b09-51c5-4a12-803e-fc2cab30265b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b3c2d1-2e1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775084188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084188, "uuid": "32a511d1-5811-4e51-b9ad-37a451449110", "comment": "Malware payload (Mirai)", "value": "01f16797629288066ac530c8cbe02568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084188, "uuid": "501abb1f-f0b7-4c62-84e3-36c1a998c27f", "comment": "Malware payload (Mirai)", "value": "bb61ff20bf46854ba1a14f5840d623bd22a09df7316f6c4bd86a55dd04f85f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084188, "uuid": "ea7e97c2-243f-4f43-9044-62f2b66e43c8", "comment": "Malware payload (Mirai)", "value": "a88e51d6dae88e76a601e0bc67a6da9a11a76c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775084188, "uuid": "9973b400-602e-4ad5-b077-e6b760745bc5", "comment": "Malware payload (Mirai)", "value": "852a7eb350c80a2f8e6a94842dab0bd8bc8772229f951e329198ad9a5ead4a4e50268d3a93734f1c2c04db303a13304a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084188, "uuid": "54d1e8dd-c64a-4d80-ac8e-269c6fce3d54", "value": "T1BCB533F648A8036F69845BDC5BCA77D0867F8000AA5CF1C19C5978C75C34BEB6E0B72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084188, "uuid": "772e77a1-c4e8-4610-aa96-85c9176e45bd", "value": "49152:Z4dsfmbwyjoNYOhqdMaDQREx9XItpw1nvoZIt4z2jdDRFx6h8:A2dh2MQyC94tgnAe40dFMh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775084188, "uuid": "fb717240-5c78-4f0d-807a-59cb7772226b", "value": 2437728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775084188, "uuid": "110cd980-f405-4e60-b619-970f7c8cb1c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775084188, "uuid": "dbb891eb-5f63-4b1d-9fa4-e8eb299f8a59", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d0fe90-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775054023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054023, "uuid": "8c99e1ee-2227-4044-89b0-d25c152414e2", "comment": "Malware payload (Vidar)", "value": "e289c2a116beb6c0d17c621c5fbd7ab7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054023, "uuid": "61383b57-2137-4c5e-bb5c-56fe1dd1ab7b", "comment": "Malware payload (Vidar)", "value": "bb623d7aab29946ef7bd97e3374bc506f39b960c7ed6b080c5804caf66562db9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054023, "uuid": "59c8c56a-1124-41dd-8aaf-cd2e9c5705ed", "comment": "Malware payload (Vidar)", "value": "e9832a2a73af50fafcbb4c38dba43f86ca0ab987", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054023, "uuid": "ccaea2c5-27d9-4eb2-af24-5bd52f0e958e", "comment": "Malware payload (Vidar)", "value": "3c8d6eab98fe6041462bc9e75cb2bfeff3e1fdd36cab19211115460e553db857c022294e9c8aef3647456e1cdb562109", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054023, "uuid": "11e82bb4-ea76-458b-8640-48b7435e4358", "value": "T18C241207E7BB9AE7F12C04F047F6B250458786019E162EFC1CA009DA5E655BD72FB28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054023, "uuid": "c941b95a-2125-4711-9924-1fe85755690d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054023, "uuid": "fdd926ed-ddc3-4a71-82ca-73d14bfb291f", "value": "6144:ceTs1LYb3pDOr8UYFrB9QAORSV0Hmb18aDN35:cgCYp8SxORSV021T35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054023, "uuid": "3e8d203c-8678-4a4a-b3e7-634852721ea3", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054023, "uuid": "9596f1f3-d8b5-4473-90bc-a079617de4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054023, "uuid": "3523c8d8-747c-4a70-93af-16b30077ca95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e697749-2d84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775018089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018089, "uuid": "32fbb6eb-1085-4bbf-af1a-e775793b68e7", "comment": "Malware payload", "value": "08afbe558795f4e55ae5dd18f08322be", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018089, "uuid": "7350cc49-f449-4af5-8fd2-0c2b7ad4d1e3", "comment": "Malware payload", "value": "bba584c9c26bfe14083256f4f2ec9ea6bcf12db3cf7e1b7424f90fccced508be", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018089, "uuid": "ca84be57-5654-4aa2-a16f-ef8e0f8150e8", "comment": "Malware payload", "value": "47a3b36f32574180b20dffbf5e8bb8e187b86598", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018089, "uuid": "dc6bac44-efec-4bff-a2f2-2276fa0bbf6b", "comment": "Malware payload", "value": "b16a4f6d54ac5d87454475b29dfa36a0c51dad67e068543223ea62422fb58e63f0515e4941f45dfed451354f10b292e3", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018089, "uuid": "bc1e1cd7-cb8d-4c9a-a2f3-976bc78fef49", "value": "T15661D27BCF35FCE0433DB0508D662E4B20E45B22DB765B68D90116BA2C68359EF2B25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018089, "uuid": "0303d7a7-79ee-49f7-8f6a-4a9cd56bdf29", "value": "96:U7vW2oukUKmJNK/5UqjQhHuFhgqUjCc5kiovVAIk5kL:U7v9vVJNhARUjV5kZvVAIk5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775018089, "uuid": "0f89d6a3-933f-4779-8b0d-53dfdeb744c0", "value": 3323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775018089, "uuid": "fdbf9217-ac0e-484d-8231-9a6127d71180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018089, "uuid": "a3aed4f0-d8b1-4446-bcb7-e3ff7847e2f0", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5794c3-2dab-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775034973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034973, "uuid": "1ea14b72-950e-4d1a-963f-6dd40742c05a", "comment": "Malware payload (LummaStealer)", "value": "d913b865bbc2ee1a60390ed9d01d5872", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034973, "uuid": "dd1afe38-a4d2-4794-8081-3de4b1ddb7eb", "comment": "Malware payload (LummaStealer)", "value": "bbdd32373a701742689d1b34d1597d6c4347758d91bea4e9cb4aa875237cd07c", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034973, "uuid": "748771a8-2f8d-4cb9-8aec-9bd8b01b98a1", "comment": "Malware payload (LummaStealer)", "value": "1ad5d6cad509f0d91bbacc4ba354ac3a1dabd440", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775034973, "uuid": "3dc8ce3e-764b-4c96-be85-66433eefc476", "comment": "Malware payload (LummaStealer)", "value": "cf2539837512ed6a8ef3122e7c48c166b9e8f074e6e97e5a76227f312b7146f91a4c67177ce0ec906aabcfc3d631cef5", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034973, "uuid": "3e8c30e9-c740-425d-a5ef-01d01b98ebd5", "value": "T195655B40EDC745F6E41617328AF762EB23369D094F329B83EA40BB79FA761D11836352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034973, "uuid": "5ad7587e-a69c-4d4f-a43e-350d04c49986", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034973, "uuid": "90d4de7c-ee03-4b47-93fc-7ac2d0333b18", "value": "24576:RSGJfepQcmQvLo9LPcfxdBI3pZvIOOIajmDzPjzA/B72kutL4cVCp+0aSBM1xeoB:RVc4gZDqkQJ8EC7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775034973, "uuid": "2c92881a-5c11-4560-a4c9-effce21d1ecb", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775034973, "uuid": "ac3303b4-ae52-448a-b8e2-842612d8d704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775034973, "uuid": "b147495f-2263-4bff-ac9d-d03383e3a29d", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4466ddc-2d82-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775017562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017562, "uuid": "724dbc94-adcc-442e-95c1-f9acd69cd4c5", "comment": "Malware payload (Formbook)", "value": "72b465f40a75b9ae15bca99d8bdb4579", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017562, "uuid": "f646ffcf-04e8-4f30-bced-ad0bda115424", "comment": "Malware payload (Formbook)", "value": "bc5a3c85389bd5622f69605687fbaa401643805f189a3bec12cb5913f7eec3fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017562, "uuid": "d263b727-6a12-4c25-a45c-f9813bd42254", "comment": "Malware payload (Formbook)", "value": "a15b8a33dca83cdfb77b9e5f6724eb9adcfe2363", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017562, "uuid": "244a9069-2e30-45df-a7ca-c54d3bf456a1", "comment": "Malware payload (Formbook)", "value": "d6e464374a198001f383dde160def61a8ec0b8e74c1b79d6f81d16f31ac06ecbb27137284729a5e6f1c5354ffaf12974", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017562, "uuid": "ceebe05c-c68d-4ac4-acca-5fb7eba466c1", "value": "T1F195F21189C46FF9CFEC5A1C80FD161AA3F04A8E5126B98AFB73BD47AFE76001117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017562, "uuid": "d57fe00b-508b-478d-a3ff-d52a99d1366f", "value": "24576:cYrAekGlMj0cJOcr+43iVgzv8IeMjtw5DYXzrY+ovfFPGUSr7JC5j8ZvP3r4+:FrePk4d0klY+hZvM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775017562, "uuid": "9833d128-e80b-4151-897e-65cfe35e8d97", "value": 1891046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775017562, "uuid": "6944f00e-9ee6-4e31-82ed-082c5329dc3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017562, "uuid": "7f945695-bfa3-4d9a-af30-411fe82d6c20", "value": "BL, NOA & INV BL NO SNKO020260313219.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0acde01-2db9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041098, "uuid": "8d9c803a-6801-4098-9160-a48aeac5d1aa", "comment": "Malware payload", "value": "7a00ce6f53c651f53f9a7770cc15875a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041098, "uuid": "64fb38f3-6c25-4484-aba0-b9af8879cd84", "comment": "Malware payload", "value": "bc7400e057f39513278a665d89ab1af5e53825edd54359eede65281b879738d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041098, "uuid": "6c1f0c84-39c4-4a62-a360-9e7fff7c0d4b", "comment": "Malware payload", "value": "d0040cb03b4e066008ab62467d8e983724067783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041098, "uuid": "da8c3ed8-41e7-4b5a-9cb0-1d51ebebcaa1", "comment": "Malware payload", "value": "1c545437c0c9fa625b950221489d37b1645fa92cf7c1c45b5ea3b0dbb215ccf3ba58033b46accc073f5a37314b004c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041098, "uuid": "d0a48e01-b735-4316-884b-b84bd9a0eaf2", "value": "T10706B0B876047DE6A66F577BDA96ACDC03B626239ACBA4CC4064B7C30563375FE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041098, "uuid": "ab8ac24d-e638-4ed9-aeef-7e6723df3bb5", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041098, "uuid": "96e1882e-7573-44bc-830b-ec3cdb029d3a", "value": "24576:mO0r72zv1OO4NoRzJMZk6dLSD01EJtIugukqCFQ4hu2xZktDKubPHYZHnBOxFYHK:mO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041098, "uuid": "70ae58f0-a738-4599-b4f8-453602ec550c", "value": 4012032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041098, "uuid": "964e1d36-32c4-49a7-a81b-600d58c1eaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041098, "uuid": "7dfda4ec-11b8-4e1f-adce-ce4ab5f33ee7", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb95cf5-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022680, "uuid": "3b28652f-573f-40bc-97fa-65bc9ed60405", "comment": "Malware payload (Mirai)", "value": "f420efeccb3799ae781045bb57383843", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022680, "uuid": "915c742e-6149-432d-91a1-3a233764c9e6", "comment": "Malware payload (Mirai)", "value": "bdd064c7894244e3b8b7465dbef00be1c64d588d8459d0d90884fd042c968ea1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022680, "uuid": "25a170d5-d8d5-4418-8138-8dc01aa4b281", "comment": "Malware payload (Mirai)", "value": "72c0076eee59bfdc9600c4595483e99753bd24f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022680, "uuid": "6a720f80-ab9a-4259-9da3-47616e822b60", "comment": "Malware payload (Mirai)", "value": "90892d1b3e392c3dbbf3c239341c8bbe34c55dd72853cda9daeb522c076125c733212752d67f9fed6b73c4be806d4621", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022680, "uuid": "a07a2907-3f2a-4a75-a7d3-136031506ad1", "value": "T1D9B3AD9BF2470661C8634AF047CB4BDE3E2323C29F1785E33D6A263918B91CB4906F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022680, "uuid": "99db02bb-c1fb-466e-922a-75fabde1e99b", "value": "1536:uMZna4nZ9kHSLdghLLUVAVh4Keug5Q/LWe:uMvZ2HSL+toQ4Keug5Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022680, "uuid": "001f66fa-b7ad-4b6b-b293-0f030162a124", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022680, "uuid": "b37a4df2-475a-46fe-a37d-8a555ba5aeb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022680, "uuid": "bc1a9e7a-6fd5-4967-afca-49b5de531c67", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f856ad8-2de5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775059913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059913, "uuid": "762ff458-48f4-4d0e-b432-1789c9206da3", "comment": "Malware payload (Mirai)", "value": "8ddb7f6b13575cb90bf396f975722d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059913, "uuid": "0eb008ad-9354-4999-91bd-de10ddd76b52", "comment": "Malware payload (Mirai)", "value": "bde354a5173817ed429712a21a4ea1bbe1c9b3005137941bc354060bcfc9b8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059913, "uuid": "b0f7a264-71f0-4870-81e1-8193db244096", "comment": "Malware payload (Mirai)", "value": "fb196b7c73f8600d041f84017f441083a0f16281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775059913, "uuid": "bd3113db-7d5c-43d6-b607-67bdeb41ed61", "comment": "Malware payload (Mirai)", "value": "61c148490b37bc9ef8701e21d2b6bea92573db58302b6dae6acccbfea153d91fa3db9f299f7be500acaece0dfb8c8fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059913, "uuid": "f8b6ea2b-af5c-471c-9a1e-3198b9f8a888", "value": "T1F3930749FD416B10D8D635FAFF4F024973934B6CE3FA7201AA245B2123CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059913, "uuid": "42616ad1-cc7f-4c58-92a6-622ee570c1ee", "value": "1536:AanWI8VRprZPFtqfBA+fITgaaalDQOhuvNKlMx8viluAYTqJZ8Yw4:x8VxPXaOcITgaaalDQOGoyuAYTqJqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775059913, "uuid": "8ba29d0f-c376-4cc0-b604-6d8694bab9e0", "value": 93276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775059913, "uuid": "a6e0b4af-d3de-4d68-9bbe-280e85749072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775059913, "uuid": "6c98e549-1fdc-43be-9e33-7617f3651e4d", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc4f5f5-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053575, "uuid": "ba6e66d7-3463-495c-a63f-79ce22246c36", "comment": "Malware payload", "value": "425a19abca8954b427f5d6afc5faceb8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053575, "uuid": "2e2267cc-3c28-4ccd-963a-f2438c24daeb", "comment": "Malware payload", "value": "be5c4f5b168d7c65a026aefe26637c5b6f402c2d6c5e0e68150b33e835587abe", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053575, "uuid": "701f64a4-cf62-4a84-a61c-3769e09efeec", "comment": "Malware payload", "value": "40677bdabe0ec1250c5ba5bd674639fd7773b66e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053575, "uuid": "bc1caf24-3e42-4cdf-aa6a-fb7181802be5", "comment": "Malware payload", "value": "9baec1323acf215b9ad6a9e900c09f2e13775f4c04e2a0172a7d52f12429e01bf0d0ba3b883f94f49a43a087650e4bde", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053575, "uuid": "31143d58-513e-4cf0-b1b0-87f3b1d9a2cf", "value": "T1315623339D48654BCA8083B1715F3E262F3E7753468CB9E7A89C59C63B0BE90D63B095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053575, "uuid": "b80263ae-7006-4c47-9c27-4433838436ce", "value": "49152:NRjzcByyIVf2g32d5AQunmRQb/hwgyjreEi37cq9pFdP6gk1nFg/keuTVGfNQ7Zc:vzbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053575, "uuid": "4b8dcf92-86b4-410c-8906-48eb4f0334b9", "value": 6002688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053575, "uuid": "b98365cf-5f65-4f6f-901f-bf3e5fd64272", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053575, "uuid": "420268b3-13cb-4cbc-8d67-3827a873a749", "value": "0Lib41338-INGU1837RU953078TJHG_Pa.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd6782c-2d91-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775023755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023755, "uuid": "a4f065a9-abee-4e8f-a275-938df7aa0a6a", "comment": "Malware payload (CountLoader)", "value": "d563d62a6a210a3ce3c6f70a05f03411", "object_relation": "md5", "Tag": [ { "name": "194-31-204-105", "colour": "#71D05F", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023755, "uuid": "d17121eb-3b0e-488b-9f1b-d1027f782a6e", "comment": "Malware payload (CountLoader)", "value": "bec7c3a4a90d107dd1f19024e44bd77a7ce87344dd68950d6f269855c1ff0f92", "object_relation": "sha256", "Tag": [ { "name": "194-31-204-105", "colour": "#71D05F", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023755, "uuid": "f9b4e375-cbe0-4b22-9633-01c24fd73b05", "comment": "Malware payload (CountLoader)", "value": "8a67fa8ecd72f416f94461c084694a8c4e1fecd4", "object_relation": "sha1", "Tag": [ { "name": "194-31-204-105", "colour": "#71D05F", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023755, "uuid": "d97babb7-f6a5-4aad-b6f7-1834e7fc660e", "comment": "Malware payload (CountLoader)", "value": "04baddf94d49ecf464993f548080683b57c6605502d109aa2c12052e88413a37fb63e98b084c6f4a365578e061a0c616", "object_relation": "sha3-384", "Tag": [ { "name": "194-31-204-105", "colour": "#71D05F", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023755, "uuid": "895d5202-5702-4b51-a17a-1df471a0dfcf", "value": "T1CED5FBE3179C0ADEAAA499E6414D3A0754F7C67B2C5D0299B8D10E47F03EE31B636B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023755, "uuid": "b5e2bcc5-c8aa-4178-b2d7-6578bbd0cb77", "value": "1536:IDNWSku2hGXl4vtnXpyu6OG4P9oOMsrODARSHJScT5BkNgvdDLFyRoYvYISzMJrw:I5WSkXynGRMdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775023755, "uuid": "442518ee-a476-4242-82a3-80ea2395dd87", "value": 2981778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775023755, "uuid": "0b73ca6f-e1b5-4995-8b60-1a7634d5f56c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023755, "uuid": "6ba6f53d-06ea-4ff5-92cf-29f869f49615", "value": "bec7c3a4a90d107dd1f19024e44bd77a7ce87344dd68950d6f269855c1ff0f92.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cad419e-2e12-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775079289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079289, "uuid": "21046aee-108f-4c37-85f6-098e54244d93", "comment": "Malware payload (Smoke Loader)", "value": "e537b9a4e7bd2faf4fb20212f753a694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079289, "uuid": "73d6d59f-9a71-444a-a55c-53dada964881", "comment": "Malware payload (Smoke Loader)", "value": "bf050e672ba5d3db564fb90022097f4406bc20916aa2334dcbf25d05089d77dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079289, "uuid": "5cdfac57-adae-4a04-9d63-094b270a2831", "comment": "Malware payload (Smoke Loader)", "value": "9fd0e46c34c52eba709ac74f761fbb569064e848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079289, "uuid": "10e0ff0f-00ec-4504-9cfe-6ae656e6fa0b", "comment": "Malware payload (Smoke Loader)", "value": "36e165c12cd21d1b105e1bf112c4c97a9575d8c20ca849c1e44edf54e5ac381161a04fc0eeae32b83916c32d59e73701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mixmain3", "colour": "#2DA700", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079289, "uuid": "a39f3e89-5083-43fd-9e39-f1c95547cd29", "value": "T154655A4B7CD148B9D0BAA33288B26292BB72F8190B3233D72E50B6783F767D05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079289, "uuid": "38471a5e-6f1d-438f-9aa6-eb669b6ee9e2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079289, "uuid": "964c1231-4041-4f81-baa3-a8cca56b7d86", "value": "24576:UpSMd334G2+/u+mWFLVfVD1PdxKcMDMwl9tH96hmGRWQrl:UpD3342xKcMll7Hoh9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079289, "uuid": "2928436f-babd-4831-8651-ca175c60125d", "value": 1485440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079289, "uuid": "a0f89e7b-dee3-44d2-b4c2-eb276479f7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079289, "uuid": "099ffd5f-42e3-4a19-ad31-6d6e1f2c0f4d", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f564bf40-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057534, "uuid": "815ae15a-e2f0-42c9-86f2-e38bc4c16d2d", "comment": "Malware payload", "value": "3ab9c12a7d0d8931f44b334473e02dfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057534, "uuid": "ebedad8d-a3b5-4b36-a503-2d285bea18fb", "comment": "Malware payload", "value": "bf38f128609b4df538dec38bbe62806e684bcee62ddb6f18fc46c002779cbd2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057534, "uuid": "b63b4acb-1367-4551-9398-490b09c81ebd", "comment": "Malware payload", "value": "096ce81643cc67eeb8dd0c83e4ffc884deca31eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057534, "uuid": "eba4fafc-7fb1-4fe7-9d60-679a9d8fef68", "comment": "Malware payload", "value": "f07276fa3a4602fd5233a88eaa16073057b5f3978142619054c1f1106f8414226c92411d9b01fedc79d81e1eee8afb5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057534, "uuid": "fac318d8-7fb9-426b-983f-de3200d182d0", "value": "T18A74490257EA5508F1F39B88AEB610A08E7B7E561D79C46C15E9140E0EF3E18D8B67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057534, "uuid": "0a283bd4-dccd-484e-83af-607641ae11a6", "value": "6144:xIEoCrmKcTZrUaYUmN7Agtw/28IT5sPA+w6Qp3nswAqvzOz798Z0j/xW/DdxkX63:xToyZcTZrUMmJ1HT5sPthQp3swDU9+0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057534, "uuid": "98bde1b5-bf80-4386-a6e2-1583d87023d3", "value": 346644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057534, "uuid": "220d42ab-5979-4c32-a72f-a85071bbf97e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057534, "uuid": "a097c1b4-fc8c-40b7-8451-ea6afb385c2a", "value": "Swift S6076122688-000008133-CN300.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471a8747-2d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775016010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775016010, "uuid": "84269653-d4ed-4eac-a4b1-0d95d6f01b60", "comment": "Malware payload (PhantomStealer)", "value": "5a3178c43b9bb195e70837c189e60565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775016010, "uuid": "031652c5-2584-4265-b0e0-70b92d8ab7f0", "comment": "Malware payload (PhantomStealer)", "value": "bf5f373bfd33cfaed340126646090dc87e291f5bc7d33aa31b9aeb7b968fe7fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775016010, "uuid": "25a683a4-d0fd-481c-8d7f-9a97e70cf93d", "comment": "Malware payload (PhantomStealer)", "value": "0487c289d9f4895e8d1655442db29ecfc674568c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775016010, "uuid": "f6b23db3-71fc-4804-824f-399221a25060", "comment": "Malware payload (PhantomStealer)", "value": "c9aeabdb8e12a2deb3facc02e9a0d8040a11a7040dc6c568d68e6cf0976b9f0635e07eaed1272d5d76ff4aa3ceabd7a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775016010, "uuid": "728acb8e-ed9a-4df5-a00f-be64131e3971", "value": "T1CE7512582615DE02D5825FB00D70D7B45BB85EA9A423E203CEFA7DDFFE39746B904282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775016010, "uuid": "a482409e-0b20-433c-b150-23c51c1cd0ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775016010, "uuid": "856becad-f6ee-43ed-8c88-b37ecd12c7e4", "value": "49152:hqUwgEnkcD6Tdw1r1TIQX/PuhARfbIKEUll37AcdwV:hrw5nrDkdw1pMQPPPZb/zl3ccq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775016010, "uuid": "db473998-553d-40fc-badf-46bde36b5504", "value": 1653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775016010, "uuid": "6efb3c0f-ac08-4d83-b234-5d707a49927a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775016010, "uuid": "7243adfa-3b28-465a-8565-1ca29e3a823f", "value": "z1PO-784378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e8e7f4-2dc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775044779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044779, "uuid": "abaa84e4-31b1-40be-9118-13850e2fda2c", "comment": "Malware payload", "value": "d9d2a405cdb5b5853e00aa33080c9ae6", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044779, "uuid": "88284e83-d408-4e87-961d-640871cbc18e", "comment": "Malware payload", "value": "bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044779, "uuid": "38dc459c-b481-48f4-adbe-bdaa0c6eb88a", "comment": "Malware payload", "value": "f0f6ae018eb64c3171bb8a002e40859c8b837062", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044779, "uuid": "42b7c099-35c6-4280-a8c7-4234f4e269d5", "comment": "Malware payload", "value": "d616924460647e78df6bb1e10cc9cc1e3a75cdac53d0039f10fb5f5f17bc98abc1e09589990951a1255f97bcab9073f8", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044779, "uuid": "7d08f444-52e9-4ecd-adc1-77d6a182be2b", "value": "T19552F88763855FACB3854CEC9514712B2CF1C56F3C29209EFBE25DD7B83AE11A5A0A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044779, "uuid": "82bc2889-4b55-4673-8439-560011a95a6d", "value": "192:evq5DU0OErBNRjijnXYzrWRxTQlcdXnWqCPuHHwOMae4uYSqGgfFPjwqaalHF53j:4UaAduYKg8gwS9XqdluS5uf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775044779, "uuid": "ee444ff4-3c68-4d6b-af5e-fa96d9d2de44", "value": 13439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775044779, "uuid": "91fc4479-dbf7-44de-88f9-3352edc04703", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044779, "uuid": "6a25ffeb-bfd3-471f-9059-54eb29ae35ee", "value": "SecurityPatch.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a99a5e2-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041839, "uuid": "19ec4789-da36-46a4-9fed-c13d5314d599", "comment": "Malware payload", "value": "c04a3d2cc93bbb38971feebda345008a", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041839, "uuid": "c66f63fb-8e74-47ff-aaa3-29c2eca2feff", "comment": "Malware payload", "value": "bff96073fd58ee545338a5a9d682240677e168355cd0d8ef819ddc50885f002f", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041839, "uuid": "c090f115-b27e-43e4-bab8-5b7139942b05", "comment": "Malware payload", "value": "ceb47e3410525ae2350ec2efe0174bd4dd2233ae", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041839, "uuid": "a1c72065-29e1-4675-97c7-f6b7337ef57b", "comment": "Malware payload", "value": "6a607aacd14ad92fdf6b9c730c2bc2d07331e7d4e56e4aec912a76d2211354144db4cb300a1d72cfe7163897f116c4e2", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041839, "uuid": "c4d80cee-84ad-4558-9b37-49954712117b", "value": "T172D5BF45B3C4AAEDD516DA388B14E332C2B2B9634B76D0CB5A9AD30A1F779514F3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041839, "uuid": "c9fdefa1-f560-440c-8528-2f8aeb133f7c", "value": "0ae8636abd085fc1a449aff3779033df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041839, "uuid": "5dfaa6be-bf0f-45b8-b251-9098ab32c795", "value": "49152:TsF3e1hmdyMKe5lnXESUYVPQTUYSYuRde4MmeYP9d0zmewjYfVHmM8s3Ne4TgFzj:dqhpPQTUYSYuRde4MmeYP9d0zmewjYfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041839, "uuid": "a15052ee-be97-490f-abf3-ed1267a4c40d", "value": 3012608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041839, "uuid": "48a64a7d-a328-46ec-bb3e-d71f91bb47ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041839, "uuid": "2ee5a26a-6864-4ae5-ae5e-f8b00f6e7e86", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7a64c9-2db4-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1775038812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038812, "uuid": "f817aaff-4fd5-4c98-be37-5965a41f9c55", "comment": "Malware payload (STRRAT)", "value": "9f86bbab6bc929a3a193ba3fea3c091c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038812, "uuid": "5c8ba4fa-139e-4048-9f3a-95dcaf637149", "comment": "Malware payload (STRRAT)", "value": "c04eecfa0ae1b15aa4042459efbb89884525d358dc01e481109972d4efa062c3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038812, "uuid": "1a7065e9-28c4-49f0-a117-5f4d69add554", "comment": "Malware payload (STRRAT)", "value": "2b6b6e33e6892340d55d0770ae46b354e5b3be1b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038812, "uuid": "a816f215-59d4-40ae-8630-46bdd1a5dfa4", "comment": "Malware payload (STRRAT)", "value": "c52822bd072c11b4767956d177b2ea66f557ef7c777f2ac53eb617442e344db764b93247f4a95ad47f82b71a79b5dd58", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038812, "uuid": "b538cc7c-daa3-4e86-8827-e209f122b7f2", "value": "T11724F21FADD6E0B0E413E4B208A14B67565C21A8C5F9911F6AFD79868DF0D1CCB229CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038812, "uuid": "5e4b59b9-a1b8-43c2-b0e6-7066bc3a8516", "value": "6144:Q/grPoC3JZzHo1yb1ki/76VicfwybXbbhvrx1HGJsvLV4W:BJZjC7c6QcIybLbhvrTmgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038812, "uuid": "2ea45dd3-5300-48de-8826-d12561f4df38", "value": 213052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038812, "uuid": "28aed79a-a282-4dbd-b381-7acd155cfb52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038812, "uuid": "1679c3bf-faf9-4934-bb17-062eedb6690b", "value": "FLT NO. TG 63528 BKK-Contract new 202603.PDF..jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b814345c-2e1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775083201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083201, "uuid": "e83d00ac-5799-426f-a468-14f3e56a1883", "comment": "Malware payload (Mirai)", "value": "0ca8cd522ba5ec712822bdd1128eeb67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083201, "uuid": "5b7dbd2b-d720-487e-9df6-89210f723cfd", "comment": "Malware payload (Mirai)", "value": "c16a1504470df06bb405a080fa5839b8496fefb842f11fa03dec64d7fb89e930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083201, "uuid": "d4b30387-c313-4a0c-8bbb-fb87332664d4", "comment": "Malware payload (Mirai)", "value": "3d83bbae650839b25d3edbdbd5f6bc68b1d83eab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083201, "uuid": "6dc92841-d09e-4b7a-bc91-7b0fc68ee0ea", "comment": "Malware payload (Mirai)", "value": "851787e7be859e6182a33f216b48c9654bce5d9d0173c3b08d7d22deae1edd4443a9c28790535fb495d1f03a64fb77da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083201, "uuid": "7eea6b15-15e8-4966-922a-58451922f13d", "value": "T17235332468894D4517A71FF980E1A1237DEB3EA31501F5C6CFAAA8D45E1033932B9DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083201, "uuid": "f3e97062-0c55-4ba9-a3cc-ca8d213a6d20", "value": "24576:1LtgPMxTuZCyMPxb0BOftAoiEkQYxe8o8yP6gVnYQ:1LtoMxTuZCBqOoEVx8y9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083201, "uuid": "668f7fab-978c-4a0c-aa81-393f12f11f67", "value": 1130236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083201, "uuid": "1a260ebc-780d-4d4f-b43f-6d4fa9bfa1a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083201, "uuid": "cf264863-dede-4c9e-9df8-08fcdafde49c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd47d232-2e0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078082, "uuid": "73e4fc24-6fb7-4985-9d12-509e71bcc5ed", "comment": "Malware payload", "value": "28a3d43f82c2064851d7f7e152d59365", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078082, "uuid": "959b53c2-c1b4-4777-999c-e46954634093", "comment": "Malware payload", "value": "c18553d1095dbdec6672f654dbf640345dc2456cc6900d9647d989740fde2f06", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078082, "uuid": "74870a74-54e4-4d52-b719-986b9788d73c", "comment": "Malware payload", "value": "5c3cc5b0186f19a058fe6edbcb984f173e109fb3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078082, "uuid": "8c76b5e3-450c-4157-b091-4fd2632cbdc2", "comment": "Malware payload", "value": "cf10618791dea22a526b9e571cc6ea8d73b7e2ffbb24855a955a870a0e2aa17eafa9641e1f32ab6474325ac88df13108", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078082, "uuid": "b7711107-bf6a-4832-aad1-a16bbd3ac777", "value": "T1CA17339554B4E8EF507D7C3AE2BCDA9784FD6221C4A141DAB17150C2222BEFA13F52F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078082, "uuid": "e599bd77-085f-416c-9c1f-518002d7fca7", "value": "393216:9FVifnNz0ziDQJXsw0DzzpHMcDC8FLF3PqJ0RQhHfXB0GkqPJ1MGVqg:D4fSG0Jcl/lm8FLFfcd1XWmMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078082, "uuid": "55684b85-9f20-47fd-b1dd-5487da698971", "value": 20303233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078082, "uuid": "7652050e-c0a0-4b29-b72d-5605d20bfcf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078082, "uuid": "5cebfe63-93bc-42e6-b9b6-9aeb62cc83ba", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39a16ab-2d91-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775023896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023896, "uuid": "df26cb88-76b4-4987-90e4-60e585628a65", "comment": "Malware payload (Mirai)", "value": "1fa592343e0bcaea4304585f555bdf33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023896, "uuid": "0b93874a-dca4-4bd6-b10b-baf836c0c2e0", "comment": "Malware payload (Mirai)", "value": "c2b4be76dc1ab3b907e99a8440e752af2cc861516d6f7749fc2a3ac82b1068dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023896, "uuid": "eb256440-c056-414b-a304-077900af67d9", "comment": "Malware payload (Mirai)", "value": "c7aa1164fac24966da8e668ce19b8a3550184525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023896, "uuid": "2255a8e1-4ae3-44ad-861d-975bb88f6ea8", "comment": "Malware payload (Mirai)", "value": "270b70d0df162e7113db130b20166d05b4bb23f60c163f411d3aa52b9e7517ede445ea5907c06daa90d48438c83262c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023896, "uuid": "bfc799b6-94a6-4977-8e04-766c53d60627", "value": "T1E6258E46F2B374BDC067C03087ABD762A936F46501226D7B35C4DA342E92EB41B29F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023896, "uuid": "e00983f5-6da5-42dd-a9ab-774c873d81dc", "value": "12288:7EY4Y/uuKU5YGWgX3SH2czmHqi6mywSiLQV5kDg/yhf0Fa:7Es/uuKUDWgX3SWcLyQFKhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775023896, "uuid": "3caffbb8-d10d-485f-9cd6-7648760de219", "value": 1000624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775023896, "uuid": "f416f6a8-a083-4508-b54f-3bb79e41e2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023896, "uuid": "5b08f7b2-e9df-4820-b9af-8295c7739feb", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb87396c-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041653, "uuid": "f40f8368-8950-4214-b3cd-57529982bf16", "comment": "Malware payload", "value": "55405de62427ac56106f0fdb1c33dedd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041653, "uuid": "3312cd62-e6e9-4d17-a9e8-1e13afc273f8", "comment": "Malware payload", "value": "c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041653, "uuid": "8bdb4ec1-f911-47de-9161-eb11eabcf60a", "comment": "Malware payload", "value": "6589718e7b026d7278a8eb8333c59b8e297f4016", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041653, "uuid": "2e40e5db-6a34-4163-8a93-6f3d3e137dc2", "comment": "Malware payload", "value": "6ae95676095ffd3814be64e4f82552dbdd5fefd012fd36f0f6bbc439373b67cec6f9912581902bb587f8c61a4e1b041f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041653, "uuid": "28036efd-88d2-4b59-8d69-ddef8ad9db2a", "value": "T12CA1952B5EB71E2153B2598B6ACF64E55D1E93837205E9D87B9C85804FCD90842F38FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041653, "uuid": "ff883227-974e-4c89-8294-179771c094dd", "value": "96:Hc4gaLj76q39DX5y7c5FHF2hv2JCLf0g9fJ8pCWjH:GaWc98YflKX0g9fJ8I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041653, "uuid": "4208af3c-d2f4-46af-9ce2-9bdd675de799", "value": 4776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041653, "uuid": "41c0dcc7-2e13-492b-ab12-ee9f8fb473f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041653, "uuid": "b0735e1d-151d-4e1d-a1fc-72c399e48efc", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c54bdbe-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046432, "uuid": "7c934652-f428-4c20-a9be-089b68ca2390", "comment": "Malware payload", "value": "5f1c14cb7946a636786521cbc15b1b04", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046432, "uuid": "3e520d89-cd78-48b9-a14c-d3a2bb5f85f6", "comment": "Malware payload", "value": "c3b8803ca6b48a94a686ebb7d3add38fdd61f2fca5a6fff1da2250732d193afe", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046432, "uuid": "394d8302-edca-43ab-a283-619b1496c1a7", "comment": "Malware payload", "value": "163168e8840431d90d484515fde90b0aea953b07", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046432, "uuid": "9b1954e7-5eed-4bc9-8672-26752c767697", "comment": "Malware payload", "value": "a70e85a1eca488173b34904ddf29a479f9ae6764a889e332a1d9e79ac961ec0d773aa755739e404e87c867d56d1d5292", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046432, "uuid": "f2853382-6844-4539-89e9-e0f1f61125e5", "value": "T1B7663332F66C2EC9E83BE57BA0A1278483D7130ED545843595907EE8B2F27CA08DD59F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046432, "uuid": "cb145cc5-bcf1-4e55-897f-12c04f9eadce", "value": "196608:+ZftUSZcKQ840uU+HB/OGUElH6XU8YYlbHXUI:+BKzKQxrU+h/PUEl0U8YYlbEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046432, "uuid": "f0d83c88-2c68-4d34-b2c4-eea0fef163db", "value": 6611029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046432, "uuid": "1fcb3667-0c6f-48ff-89ed-9a5348de796d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046432, "uuid": "ce4028e3-b9ac-4953-b5a6-95f47dafe8bf", "value": "oxfordmobilexray.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa256c61-2da2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775031342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031342, "uuid": "70798a7e-d031-4d94-b564-7cbd8e1324dd", "comment": "Malware payload", "value": "6d6614c0266be35c24fc9cfb657e9d45", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031342, "uuid": "15515b42-2257-4290-bf1f-92d0eec7e33c", "comment": "Malware payload", "value": "c489ffa503624d6de25bed8ea8b340c6f9caa239010b47bb4e433c4dc360b30c", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031342, "uuid": "02d3ade8-d3ab-4671-8376-8996f01e4a9b", "comment": "Malware payload", "value": "6012a4c5b457e42f3e4f0cccdf923a3c19424f51", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775031342, "uuid": "aa07ea2f-2392-40ca-979b-b0a036046daa", "comment": "Malware payload", "value": "f2ec71424ba803f8c9bf8fea0e77e639502c7b38a2aa9e9a56ab3859c933a04399eb48f0dd0ed274f307df36a24e36b9", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031342, "uuid": "94729ef7-5a4e-4fae-91be-2b258c816883", "value": "T1F71733E4C389F4D5C51A8F70FF0E5289DCB245957D05C718F90EA3AEA3F3821B469A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031342, "uuid": "e4235b9d-ea80-4dc2-bf50-bdbe004a04bb", "value": "393216:LAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:LAJw4FVUHjor/n7WG05tUCV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775031342, "uuid": "3cbfccf0-32e7-456e-9c21-75785665eb47", "value": 19814400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775031342, "uuid": "098891d4-8afc-4472-a39f-a4f2d071c95f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775031342, "uuid": "ac5e4485-d80c-479a-9bca-15653e61641c", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cfafa5-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775057741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057741, "uuid": "8aa2578f-f65a-42a1-86d4-968fec4bafe6", "comment": "Malware payload (Formbook)", "value": "fe31c25a1cdeb856f85688b3665ec38a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057741, "uuid": "dd270908-79f7-4a41-8472-cdc744dd2ca4", "comment": "Malware payload (Formbook)", "value": "c543d899e55711674e258735d5521b70110c6de5de8c883b959c42b87e1ad331", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057741, "uuid": "7fa7e5e8-34bc-44f8-8998-60dde0957c20", "comment": "Malware payload (Formbook)", "value": "ee5bc0811cdabda267fe208e837f846f83c96aae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057741, "uuid": "debee433-8580-4f7f-bc7a-405e80647057", "comment": "Malware payload (Formbook)", "value": "d5ced9c10776d5017c5f696d5888a0cd383488cc42106782bf2cfe8e755ce636e7c690ac4dabd7bf3a9ac277bd6817be", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057741, "uuid": "54f35faf-8667-417c-9e21-7e052920ea50", "value": "T17AA5021189C42FB9CFAC5A1840FD161EA3B04A9F9417B98AEB73FD47AFE7544110B2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057741, "uuid": "f33f1d0d-9123-4e74-99be-67ad20224df0", "value": "24576:xZhTzWsQ//GkWJqvnvRedNDy2apmVk8MFiR4R6MjK/yHTSgC9oJbCNMVBpWOJqkS:h2n52yrgNN+6yH26R9Ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057741, "uuid": "9c80bfa7-bf0c-4a03-8e19-a7d679a78cf0", "value": 2102025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057741, "uuid": "b91fb6b0-b102-495f-9f13-de87271081d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057741, "uuid": "9b021f5f-ee6d-4f88-b7fe-b1ae45242c80", "value": "SAP Ariba ADNOC Contract.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb94a16b-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775039935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039935, "uuid": "bd627991-c663-46f0-b48b-a461a6ba01d6", "comment": "Malware payload (AgentTesla)", "value": "22c7f9e60a7675325d7c7294a34e82d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039935, "uuid": "f8b638b3-74a8-4fc8-9400-4bb713a88eaa", "comment": "Malware payload (AgentTesla)", "value": "c5da47d70f71c5aae4980e0108a16e7ebe33d4e90e08890db61322a645eeb115", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039935, "uuid": "5cee5ae7-d976-4735-a34d-74cf896af1b4", "comment": "Malware payload (AgentTesla)", "value": "207197202091aa035989c7c37097dcc414016ae1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039935, "uuid": "1a6b8f0f-bf2a-47c7-b0ad-3fb99d8a485d", "comment": "Malware payload (AgentTesla)", "value": "bbcd0688f60c95125c97ab4a0eec8b74628e8c13596e9f8a1d03222869641c9e3ad70761d00bed062166c362a42e3de4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039935, "uuid": "2402dfbb-3e65-42e5-99e5-6acd2985d3d1", "value": "T18165021189C42FA8DFEC571C50FE1A0E93F04A8F4456798EEB33BE46AFA7A44111B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039935, "uuid": "0bc2c05d-c751-4bf9-8f4b-f0806e79354b", "value": "12288:6XdGNZ51n4HxfQ5ZycPBxwBkuVliXV1K2aS04Ev5tPVosrOKM4ZP19yzK9ZmtuhM:6I51n0+ycwj/S04EvBosSRCNKWHlcHU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039935, "uuid": "1850413c-18c4-4b19-95fd-347f53829382", "value": 1518353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039935, "uuid": "22393a87-8b74-41d0-ab7f-54dfe9c701e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039935, "uuid": "e80d9bfb-02fa-4221-ae65-7c8a32f18c8c", "value": "Cotizaci\u00f3n_247_20260_Pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47082b78-2e1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082582, "uuid": "434a343d-0131-44af-825f-07cb1871cd82", "comment": "Malware payload (Mirai)", "value": "4161169e199d31171478f01a0087e69e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082582, "uuid": "cdb28264-70a5-43b6-b3f1-ad9577ad2b1a", "comment": "Malware payload (Mirai)", "value": "c5dae1ce8ce54af6bc97ca6299cec95296a48e17c8b4219851d6918e45853192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082582, "uuid": "8e5b7806-37ad-4a81-a972-709607e49ebc", "comment": "Malware payload (Mirai)", "value": "608919e3356613e28fd01cf1712b9c030c1aebb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082582, "uuid": "68603af1-ad9a-4dcf-a1ab-44b88f1dd270", "comment": "Malware payload (Mirai)", "value": "a75671182012dc10ac8840dd3054b4cb9e1fd0f0923bfcc083d01927a60956c9dd390e2109e6eec532b2011eba7773af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082582, "uuid": "df038929-a2d5-45f3-b225-8455272da2a3", "value": "T1B28533A12EFC42EA63045AFDF57ECDEA4595B0E0CD425DBD326A77508CD21F86A34223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082582, "uuid": "b6acd502-b3a8-4bf6-96d5-c92ee7be9e49", "value": "49152:WsQS4qWG729ZZU5fX3uRipih5FBgspXCUedNVW:/Z2Nqckih20CU0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082582, "uuid": "f1ce46dc-14a8-4811-ae12-f60939b8bd07", "value": 1840008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082582, "uuid": "cadd1d58-13aa-4c0f-a20c-ffd3f6ed0ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082582, "uuid": "05ee6cf1-3690-4b85-8ee7-6caf4b85de36", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ab5181-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057583, "uuid": "a2ef1d70-1219-43a9-9e70-19722d200ec9", "comment": "Malware payload", "value": "1570fbfede2b241d1ac65d777fc0f514", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057583, "uuid": "a12eeaee-7548-4307-a732-fd0ebe44e9af", "comment": "Malware payload", "value": "c6c0e723cfc8bc80ec71b0f02627cf3030c27f6aa209b23cbd94d041eab64384", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057583, "uuid": "a1d775b2-f7b5-4c6c-b4a6-4109208376fa", "comment": "Malware payload", "value": "282770c4df305faac202775a414df084c2bbbb62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057583, "uuid": "74846153-0c88-4fcc-9c0e-fd56951ed4ac", "comment": "Malware payload", "value": "a58e1a22244e0bdcdd3b07d6a28726f42ae5a7e5ed2df64e0daeb7fe93f99cfb2901098d170e3948d944d9172dace0e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057583, "uuid": "b1c31649-92e0-44e5-84d1-f6f8f5c40d2d", "value": "T1B9861302CDDDEEDBC09C412EC836278C6AE65F68C11B5592B56F3460895CBA0076FBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057583, "uuid": "24d7f906-b68f-4cbd-9061-b437f45e9bb4", "value": "49152:1ht5htPht0htThtYhtjhthhtFht9htehtuhtoht4htC:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057583, "uuid": "5acfb419-41f5-4eb1-8944-5ae53b678660", "value": 8511390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057583, "uuid": "fbba4f98-2c06-4ec9-8181-4589a50635de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057583, "uuid": "8acd3614-1e62-47f4-8ac2-32c2046815aa", "value": "James_Smith_Tax_Documents_2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fba598-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775035892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035892, "uuid": "f6f9ec5d-356d-45b7-90a7-a0d3ae772933", "comment": "Malware payload (Mirai)", "value": "09cef530619995fbc527a98475f942f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035892, "uuid": "b310d201-8fc2-4b0c-acb0-444def0ceb46", "comment": "Malware payload (Mirai)", "value": "c707b0e45191524a58acd5b82c5d7c87b9d2a1a2b52f3d29bbd41559863b9c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035892, "uuid": "d6e76908-a215-4d22-93ea-4e679a6d4681", "comment": "Malware payload (Mirai)", "value": "9ddab85e3874454cd8d286899f48776d24b0cf8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035892, "uuid": "ef1d560e-0a4b-49cf-a2cc-9a856a0471a0", "comment": "Malware payload (Mirai)", "value": "b9e608e61fb9b8c36ae6f9d3ee92d3c7b4c73342fd486050a5f2edc7e16cee3078cec44e647453d09b771a134997e1f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035892, "uuid": "a51d58cc-77e5-4b56-ad42-b6910c2653df", "value": "T1F21429CBF801DDBDF80BEA3A4C531909B170B77214925B372257B967AD3A0E50927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035892, "uuid": "ddba4cb4-fa90-44e3-a35a-bd3d928171e5", "value": "3072:V3D0W6+PRn0wVQUW5SuM+uOT0mhgO7qIpjzJH+1Y+3PTJ9lZ++fFEVNjbihLCXVu:N/LnHfAS2pzJH+1R33W+fpLC7yXEz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035892, "uuid": "e5595c28-fcd9-4745-b528-4dfcd7fd73ab", "value": 200608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035892, "uuid": "f3a61e6c-f11f-4cbc-9972-1c8688a93cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035892, "uuid": "2cd2bd0b-03e5-4c01-995a-3b9adf96207e", "value": "kurayami.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b93178-2d67-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775005626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005626, "uuid": "23449edd-9907-4469-a39d-5acb423c8fe3", "comment": "Malware payload (ValleyRAT)", "value": "21526dce6982f024428562287ffb67cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005626, "uuid": "d41fd58e-fc93-45c8-a104-642b65d741b6", "comment": "Malware payload (ValleyRAT)", "value": "c709ed855b596e46c4df8eb3ff6d50ca55869ae9deb59e04a49fd2df31f77c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005626, "uuid": "f799bced-af56-4214-8ca0-3a16c443ab55", "comment": "Malware payload (ValleyRAT)", "value": "e36657a35a1aa44dd0b2c5ad95e59368e5fc2b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775005626, "uuid": "a4b4fc00-02e0-42cc-8b4d-5101a2d6b9d2", "comment": "Malware payload (ValleyRAT)", "value": "2a4715650c39e8c786d170bd147d841e9f6618d2a926e6c17831a70011f342f6b6aaabd4d895b1451542bab4b8836dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005626, "uuid": "de0d362c-4641-4162-8a1f-f74d72366cc8", "value": "T1F4F56C47BAAB01A4E1B2C13CC9A7914BE6763C019B304ACF129C674A5B777F05D3BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005626, "uuid": "ea44c4f8-cc80-491c-8237-a870a94cb834", "value": "61b4bdff5a843253fda17e1b05c1163d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005626, "uuid": "baa30bd2-e8fe-4fd6-8add-49a7d0055108", "value": "49152:x6bLRVZZjSbhiPEh0bDb2MqHsK8uz8nTF5ag35n/CNX7Jsv6tWKFdu9COPTvG74h:xcbEz8DbNq3ijQJsv6tWKFdu9COiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775005626, "uuid": "c8171aee-1d93-45ef-b431-81e33f953d26", "value": 3450880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775005626, "uuid": "b4ccea47-9869-45e8-8b52-2c7eff422d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775005626, "uuid": "8510a0ef-674e-428a-b39b-90032fbaf24f", "value": "2 0 2 6 \u5e74 \u7b2c \u4e8c \u5b63 \u5ea6 \u8fdd \u89c4 \u5185 \u804c \u4eba \u5458 \u540d \u5355 \u4fe1 \u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8edda7-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775057467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057467, "uuid": "041f8b34-c684-42d6-bdd5-d8464d6bfe7c", "comment": "Malware payload (VIPKeylogger)", "value": "f9c30f7ad25170104e682f4837946825", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057467, "uuid": "471cfbdd-6e41-48f8-93ec-02100e1a5971", "comment": "Malware payload (VIPKeylogger)", "value": "c7175d6f8c00015dcbe488fc18ad81e7893417ed7c094eb8f87dc1b1f2a60a94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057467, "uuid": "fb285a1a-4bad-456c-a177-646e5ee35d2f", "comment": "Malware payload (VIPKeylogger)", "value": "fa333da587c28e40c65be37d8584f0aae11e7dca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057467, "uuid": "a336f822-8bc9-4e9a-af98-4f241e2ac8ae", "comment": "Malware payload (VIPKeylogger)", "value": "12a27ecca409abbee58c65d2e6ee4bca58642bc91d97f2c86827de0c85aae48c0a2876ea9be9a123a1ddabc3b9e7ff6e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057467, "uuid": "0dab7bab-bddd-4b4e-a4ce-9facd8e5753c", "value": "T11BE36D20DA25027A4F872B9CFCA50661CABDC319453744B0F5DE470D920A9ECF3BDA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057467, "uuid": "4dc0fe68-6ea8-48ff-873a-b17ef99d2c13", "value": "3072:dHhIW62bNzIxRK9rxrOHFE+42XMJIY0Ykey9S8R5C/gwIre:dBIW62bNzITZ3428JDkeyL3MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057467, "uuid": "3775b2bb-95ed-4871-b372-e716c0b64ef1", "value": 144974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057467, "uuid": "0528b15d-dfbf-4fe4-aa2a-e9b1f0862385", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057467, "uuid": "dc798f47-65c1-4685-9505-a508993fe9bb", "value": "2703170862-045243-sanlccjavap0004-11634.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7ee948-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080794, "uuid": "8b10ad4a-42f2-4a6d-a14f-b705025b173a", "comment": "Malware payload (Mirai)", "value": "173c5cd5e5522c6e16e09da8a346f247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080794, "uuid": "acbf40db-a2cd-4e70-82f0-d9c665995be5", "comment": "Malware payload (Mirai)", "value": "c722d2ea5ffd6a8dadb10bf053f1f172b2fcf5e76d8c8fa4fd7a87460afc77a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080794, "uuid": "80de7b0e-d638-42de-80ec-5edd412eb1ad", "comment": "Malware payload (Mirai)", "value": "fe4689f63dee0447fd81e9aefb5fc74f9c5b5ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080794, "uuid": "f186363c-c8c7-4130-ad60-ebcaecd4b4da", "comment": "Malware payload (Mirai)", "value": "52a5ec797ff7260ebed9260532b22433f2017598b0bb11e8c6b2e8985bf1f67a3ee0d54d825e29deaf78603b03e14a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080794, "uuid": "46bf0b15-87cc-4da4-a961-397fcf4dc3d6", "value": "T158446B92B91E7D3FF2630E3FC1421A497A3DAF119903E926B05E654A1DFB1C24F6620D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080794, "uuid": "db09eeb6-667a-463a-b323-e4762724d088", "value": "6144:DOU7L5vUWCWxrdSHxRUEv+IC/rvMQX9o8elPi:DpZvNCWzcj1QXy8elPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080794, "uuid": "2092c31e-62a6-4c05-b0a9-5a742dc0f907", "value": 267972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080794, "uuid": "12334958-aa1a-4816-bcb8-8eda07fccfcf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080794, "uuid": "ce346511-a899-4adc-b523-d6e99a6a058b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53cae93-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053588, "uuid": "00afee39-1877-4c17-a60b-1a3ae7ea036a", "comment": "Malware payload (Mirai)", "value": "998557e4da9daacb743a9cf85cf53428", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053588, "uuid": "8ada6842-9ee5-4ca0-8522-c139572f47eb", "comment": "Malware payload (Mirai)", "value": "c76a44798598a9fa8df928f33fe4b80409ca1d9a8b6122e564bf25af3ad6c072", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053588, "uuid": "4bdb6cda-661e-4fca-ae76-451f7c681c56", "comment": "Malware payload (Mirai)", "value": "3a57da74d6db7af1a1d776ba7f7ecc2647e71414", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053588, "uuid": "9d3487fc-d386-47c7-bee9-94f4c2d22fbe", "comment": "Malware payload (Mirai)", "value": "215508480831f501336db9e07d2688957e41f1a58666a38cb939164c895927403d7cd0cd1a3e111fa01dde8e954604e7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053588, "uuid": "e9282002-e0eb-466e-9908-bf5bb06aad27", "value": "T119D3C021E4006DD1EC2129F578BA97B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053588, "uuid": "35c17951-be19-478c-bc93-b77ccff70419", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xl:PiySSGp+PMmT7zMplT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053588, "uuid": "1064a8c1-b2c7-41d6-ad3f-5e6fec9ea8bd", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053588, "uuid": "be821345-3d5a-4adc-9186-78c06cb3152a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053588, "uuid": "9beb18a3-1142-4679-87b2-813700f632e2", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df786c9b-2e13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775079831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079831, "uuid": "73fd5118-5222-4e71-92ba-c529ccb9602d", "comment": "Malware payload", "value": "cac3dbbaaf45e05912676501adbf78ce", "object_relation": "md5", "Tag": [ { "name": "77-238-248-158", "colour": "#A8090D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079831, "uuid": "3a0d56e8-2de5-4d0b-9575-e7d808e1433d", "comment": "Malware payload", "value": "c78ab5681ef9ab603d45f1cfd92caa1b557a0d483adbabf462c1473e01a33653", "object_relation": "sha256", "Tag": [ { "name": "77-238-248-158", "colour": "#A8090D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079831, "uuid": "3d06ad3a-b56b-4117-8b21-c2736e72f5a4", "comment": "Malware payload", "value": "9435395184c53434651ae4c4eb3e1a837424f6c4", "object_relation": "sha1", "Tag": [ { "name": "77-238-248-158", "colour": "#A8090D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079831, "uuid": "148846ff-22f4-45d8-92fe-102630a05235", "comment": "Malware payload", "value": "f263b75d07936cc3f43ff53caa2f19b44740d534653a997b6588e1b8dad2acd403f18d820ae92a0094e12f5060d755dd", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-248-158", "colour": "#A8090D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079831, "uuid": "6cffbf90-1058-47d0-bc27-87ff560d9d39", "value": "T1DD373315D0D1D83FC5660E31C029AA649F38BE251762CECEBB81B18D8CB6FC1A37655E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079831, "uuid": "09125f33-287e-410a-ac86-6a642c343399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079831, "uuid": "32a3212b-3cde-4869-9908-7920adb126a7", "value": "393216:Njre1ZaaqWNBTqk8Ph9mZinYim4BfFvih57Fy17HrSVauRGmzxiK5YjGGwF:diaaqW/Tqk8ZainYim4BfFviX7aOguRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079831, "uuid": "83130231-5cef-485d-895f-9a0e8ae9e2de", "value": 22503904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079831, "uuid": "4b2891c5-3404-44b3-88ca-22384d88d941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079831, "uuid": "253ed303-907d-4309-b439-38a300369b12", "value": "Install.v.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e21c4f3-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057575, "uuid": "ad4233a6-ac0b-4394-ace8-732d14c5322b", "comment": "Malware payload", "value": "b06ddb975a024714cf290ffc04eb1f3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057575, "uuid": "0526b157-96df-41ed-b3e3-cf6c87f87441", "comment": "Malware payload", "value": "c887bbf032e76af821ecc7c261913b76a08301f340f1a28ae6dd0f86e831d08b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057575, "uuid": "979080db-ce47-4ec1-914b-73a662e321c8", "comment": "Malware payload", "value": "73325a182b584c37bf3f6d2ebf29ff2cc6e23eba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057575, "uuid": "8bb7f306-70be-420b-bed3-4e0808ba4ee4", "comment": "Malware payload", "value": "38de6676b80c40015361657ed8d407f6714606e1a41bdc32fd7b1214cd2f259bc77ae4bf9cdc00e80e9991111462d3c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057575, "uuid": "29b7f831-9bb9-4225-92e7-af26556c068a", "value": "T1CFA5021189C42FB5CFAC5A1C80FD160EA3F05ACE9416B98AEB33BD47AFE7644510B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057575, "uuid": "0f42f180-bb39-476a-afbe-f85bb21ef55f", "value": "24576:u/EJUCpdplf6oIdkiymZcADnIX+ynxJwIKj3LWwODUj7yCnlhoGbvJrI+qq/7Vgl:u/iA0u49wODiS2JuijY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057575, "uuid": "79312bf2-8360-4165-ad19-4c04825ac3fc", "value": 2198337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057575, "uuid": "084635db-67a8-4075-ad9b-5d38d374fd33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057575, "uuid": "531d412e-b21d-45c0-885b-1f6c4130b4a5", "value": "shipping doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80b4fd6-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053619, "uuid": "56e811e2-ede2-4d8e-a7d3-0db2b6bde57e", "comment": "Malware payload (Mirai)", "value": "e758c0f17afe97d9c794d3bd68fbdac8", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053619, "uuid": "1ecc563c-cbde-49a1-badb-be4611d70569", "comment": "Malware payload (Mirai)", "value": "ca96fc9183ce01efec68233bab25837b3f506e8ccb54dc3bad9976bdf012c40a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053619, "uuid": "0038eda6-069d-4067-8248-57a3374ccc36", "comment": "Malware payload (Mirai)", "value": "39db68c62220ca77abaad3d00d77efe194da6b3b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053619, "uuid": "d0d04591-0b34-4f1a-90c1-e22cd48abd0d", "comment": "Malware payload (Mirai)", "value": "aa2c8818a3d2622c310f4180418f27a0679e5efb6ebd4823830b42bd0fba7c3aee0ea728826fb6bd4b8c6c97ca918981", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053619, "uuid": "cef03d18-b2cd-4327-94bc-1ff671ba7159", "value": "T1F16302CB7EB03B26C09CA2B1703815D9CC3ADDCAE653865DD7D1A7960B3842661CCB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053619, "uuid": "02529890-71fe-4aa3-b080-eae6b26e4ee6", "value": "1536:SaxZLmYKVDNSl2y08yumeJyGYVmIMGibyNM:SaxZLmYKX+t08jmeJhYTgyNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053619, "uuid": "a2ed2618-7129-47c9-9424-a040c9a0d84e", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053619, "uuid": "9616ffc7-489b-4ae1-acb4-c3908b4cc333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053619, "uuid": "736ea8ad-7c73-4609-859d-801b360b9c77", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05eceeb-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053606, "uuid": "28f1eabf-ae36-4510-bc54-8943038ef648", "comment": "Malware payload (Mirai)", "value": "589e9ec968a495c13eefb0158c29863f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053606, "uuid": "7d80ed22-cf6a-4e23-82d6-97eab14bb488", "comment": "Malware payload (Mirai)", "value": "cad72da6c1967ed10fc55bd37f4624fee16511074a8afb7f9a6f1d9c9c37e282", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053606, "uuid": "02a64e60-c820-452b-be92-e6f3b1f41a81", "comment": "Malware payload (Mirai)", "value": "c90b0a3ed6927125efb0d2a39b7fe5f52f6a9dc7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053606, "uuid": "0d7fdb30-3a71-4426-8bfd-65849119a930", "comment": "Malware payload (Mirai)", "value": "3e80d5434f857dae9e40956d8123c77474dd8fb45fa6f8d0d13452bf25c2ce2d43d757f4dc67bcf721dea3cab55297ff", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053606, "uuid": "1a09f8ca-9fb0-4e80-a2e1-abc11bd3fb07", "value": "T11B04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053606, "uuid": "a3e05d1a-2c76-4dc7-bfa6-33b4e1356099", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w6UXS:7eJpJUVD1A8n0YNgEJi5aHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053606, "uuid": "ab0ce13a-4a58-442c-96dd-fba664911db6", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053606, "uuid": "b7c3cc2d-29fb-4035-897d-dee74bfdce77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053606, "uuid": "20e3be98-9bc1-4ecb-b3a4-38466cb248f8", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656af9bf-2e01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775071895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071895, "uuid": "ea1ad79e-b0c5-4644-a2fa-419004672e2d", "comment": "Malware payload", "value": "70b4dc6765860e58793c85645c690491", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071895, "uuid": "dfd0c7d4-8ced-4de4-9403-060e0aec609b", "comment": "Malware payload", "value": "cb574adcec44a9b051269d23bd4567b876253c068c3b30835ff38aec85d49d55", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071895, "uuid": "36e16193-12fe-4d9c-8800-79aca3be076e", "comment": "Malware payload", "value": "1c5ef7ee0afe774d35325a4133ac26c4f2c02ad2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775071895, "uuid": "9ca47ce7-595f-4be5-bad0-a3fa1121b940", "comment": "Malware payload", "value": "3629473849c8121204fc27fe7d6031e5f1ddf134a48973b00449246f93f2068f9010b394e99f367386619593ad357b92", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071895, "uuid": "a6454abe-5e77-48c9-9fbe-d6c3df09249b", "value": "T14CA6233A7948C03DD96361FB810BE5F7A40B9AE8D047DA1725B609AD0834D5D0B8BBDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071895, "uuid": "44568f3f-b971-484c-bb15-034b5577b529", "value": "196608:7ilcJkP38GVI+VdtettYHXKGJRfAPyexmUYTzTnIFhCDulhLlqG7sOkv/:Ob33lfgqXxvAPzxizzIFhCD0hsm7kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775071895, "uuid": "6e63d855-8b0e-412d-bfbd-4db8d0466015", "value": 10183894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775071895, "uuid": "d0f362c3-aed1-4eb6-8c7d-2f4cc6d5bb2e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775071895, "uuid": "751ff472-35bb-46c0-b7b1-908899906205", "value": "out.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f7ff65-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022683, "uuid": "3f881d32-6a76-4fb3-a5c3-46490ac058b1", "comment": "Malware payload (Mirai)", "value": "7919151e719f835eab006c5a1c910277", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022683, "uuid": "8d597a72-3556-4b58-b5d2-a5df9bf3f01e", "comment": "Malware payload (Mirai)", "value": "cb912d3295673bb37e533d3c8b61d347ef1ba344c3c33f51552dfdc9c2eb44aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022683, "uuid": "5803a906-e6ab-4650-b4e3-697640bc4904", "comment": "Malware payload (Mirai)", "value": "6b555051ce4628879d2948c50595da2a4101361f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022683, "uuid": "b743c26a-e6a3-4b85-aa76-fecb265c3ea7", "comment": "Malware payload (Mirai)", "value": "bb48f943a0f7891e5bcc1cce4d676499bcd672c1bd0b90b2a8d4bfd8d17c508ec13fc6c6a464944a427b22e98999ecc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022683, "uuid": "180d69e1-8451-4f02-a8d1-4d3359af9cf2", "value": "T15D51DEC651880C349D636E53EA76C19C71CA917128FAEBE5DACCF5E4814EE983940753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022683, "uuid": "6dfb91dc-d9e5-4b82-aab7-3acd59afe5d0", "value": "48:vBA7gA7N7hBATA6GBAg7AzPBAjAKWBAdAoUBA7dA7o7UBAfWA3bBAQA9RBAJAcgR:vBA7gA7N7hBATA6GBAg7AzPBAjAKWBAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022683, "uuid": "3717c6a5-33e8-4b4e-bdc5-c19260a16d48", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022683, "uuid": "35fe0439-2f63-442c-812b-c8585969c9d2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022683, "uuid": "06dc1fb6-f671-4ec5-ace0-2820095149fb", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92cdc2c-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041622, "uuid": "1478af93-fcf2-461d-bfc9-a8b98ce3ad98", "comment": "Malware payload", "value": "9ff561b8eafab948621470ffab74cb7a", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041622, "uuid": "baa798fe-de87-4827-9944-ed3b3ff0fd9b", "comment": "Malware payload", "value": "cc82ac5aa6784a36bdf0d3aef1f61c3de78a2c92d2b89055aea8e9f36fd846f5", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041622, "uuid": "01358adc-b9ef-4bbf-a827-112f4b534cdd", "comment": "Malware payload", "value": "dd167ba5fde2efde857be3f6a80354279af7414a", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041622, "uuid": "7c2e2ece-ef30-44c4-9198-94ac83d1d285", "comment": "Malware payload", "value": "60f4764e10e7bde453845f7a3b935d39c4235d99a106f9d6921be7e0d12d6925036405cad642f23195d2977c890bfea9", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041622, "uuid": "5f431d3f-9b72-4527-8d26-11f766c82fe6", "value": "T18D62EC576A7A5630C6A20777A9DFB0E09A2FF3073345F4A836DC82D44F8A51943F35A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041622, "uuid": "73175f3c-d521-480a-9140-ec3be84f31b1", "value": "192:Im/d/PvU8oXcdRaSoeKFaWc98YflKX0g9fJ8ISzsx471dUg8Rrp:IMvUdCRdokrt4uoxofhsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041622, "uuid": "24f784da-2195-401b-83b3-0c77b35458e3", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041622, "uuid": "35e87caa-7119-4456-bcf9-1c06764754b3", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041622, "uuid": "c876696c-4d72-4859-88d4-d6c2751ee7f7", "value": "b7d2a540e591492a71fa7921fdb692187d62ffe44e341114ad58105db6cf6d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9b9caa-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022705, "uuid": "00c2d1db-b48e-415d-9906-021f82adf7cf", "comment": "Malware payload (Mirai)", "value": "a6225aeb89e540d74af592dd6a3198fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022705, "uuid": "b219b5de-40a5-4a8d-b371-30864f3bcaf4", "comment": "Malware payload (Mirai)", "value": "cccf2a3b8c1fe87f12834c04c0378c5db0871fcc89161c2e305139c2fdc1120d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022705, "uuid": "2eb4ff67-5ff7-4365-9890-08c270a681dd", "comment": "Malware payload (Mirai)", "value": "709fa333621aef5556f5d946a47604caf1887d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022705, "uuid": "5ffffca6-2e24-4593-9eb7-beba616e7077", "comment": "Malware payload (Mirai)", "value": "cc4cd771ab5a5aa232a035b4f39cca408ba0bbed6954abfd9e522f7cd0a05ddfbeec388d69d39c38471f4d39342dd494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022705, "uuid": "b94dcc07-2cb6-4540-86e6-25b490fea370", "value": "T1BB333B42321C0E27D1931A70253F5AE087FFE9E122E4F285695F8B6A8A75E371446FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022705, "uuid": "709263e0-7329-49f7-91d6-b7fd176d30a9", "value": "768:d87y5KB8Ro7zRYJAUWY9emCWv9ChkfNJa8G/N2P6BwEGxStCJFh2hWZIwEU:2y516zYJmmC6kkfNYX/N2fPUtuFh2oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022705, "uuid": "b68f8ff6-22a3-497d-b61c-1a05c2eece8d", "value": 50960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022705, "uuid": "96f0813f-b145-4af4-acc5-6c066eb47e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022705, "uuid": "a85c9f3e-1d97-4fea-a0d4-e210975cb587", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e209c4a-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1775028584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028584, "uuid": "25dae434-5422-457d-8cfd-2ba5ca975c71", "comment": "Malware payload (Expiro)", "value": "a430da7ef601bfce5a5b35978133b674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028584, "uuid": "87bbe14f-624d-4aea-a2fe-c5d1abacba20", "comment": "Malware payload (Expiro)", "value": "cd61eb9560bdc03e412c1972d958dad51a50cd3da5ef89a643bb3db92011dbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028584, "uuid": "e89492af-b493-4f50-b83c-c44812164713", "comment": "Malware payload (Expiro)", "value": "e6bf5b097c1d44fab3d59b311d88c4468a56d498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028584, "uuid": "27f32938-1d0a-4677-bd6a-7614e1eb08b6", "comment": "Malware payload (Expiro)", "value": "4fc7e90eb6e784023fac289b7ff46eb3737e24abb3e1489ee898e3de6354942ee7061bb875c8dfafc06436df402020e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028584, "uuid": "fa311ecb-050c-45fc-814e-0e2735704c65", "value": "T1EE85E0027381D062FFAB91734B5AF6115ABD7A260123A61F13981D7EFE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028584, "uuid": "e562f793-95a5-4c36-b65f-cdbc0122a84a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028584, "uuid": "77ee6789-b8d7-4001-804b-0883ad146275", "value": "49152:jPVtxLZeJbInQRa6DI+TNDDmg27RnWGj:ztYbInQNpDD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028584, "uuid": "a3960b9e-89ab-4880-bbd2-872d47910237", "value": 1803776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028584, "uuid": "d6af9155-a793-4bcf-ae0d-3253329422f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028584, "uuid": "b4f5befa-cdea-47fb-a6db-0d521b1ee7fe", "value": "Approved pending invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935802c6-2dc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775044484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044484, "uuid": "a50c6c82-4735-4335-9832-fed0dc2856d0", "comment": "Malware payload (Formbook)", "value": "263bef23652302d7bfff37ed315f00cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044484, "uuid": "3ead23e6-6f7a-49b0-ac24-5c37e017c136", "comment": "Malware payload (Formbook)", "value": "cda6a5e6cfad4f58e6953bb9365b6044880899c6c0e079b1a68a4f193a2f1a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044484, "uuid": "b4e845f0-278a-40fb-9ef2-b735c8afc2c1", "comment": "Malware payload (Formbook)", "value": "f878c2d6c10f14662f074a4fe7d3504f2da3636b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775044484, "uuid": "f1f36ceb-236b-49d6-8786-84bb034df12f", "comment": "Malware payload (Formbook)", "value": "288522336b866132fc965f221e4fcbd82b900303b8d8bdaba92861db24cd296eb10f5a95b009a8e9fe7aca25bd7c98e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044484, "uuid": "2335f458-ad43-4ef8-9b79-a8397a737559", "value": "T1F635F1442369E902D0A65FF00D71D3B847B96D85A412D313CFF6BDEBBC7A7916809293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044484, "uuid": "23522b64-d2d2-4e09-97c9-6d14152153ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044484, "uuid": "877733d0-3de3-4e4e-a342-48ce074e23d2", "value": "24576:P/NOASOd0Z2B5HN1mZZ/5xaLHBLA3XPK1riHdx47FVi5PUpA:tFSOdTXMnazO0rWHyVi5UpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775044484, "uuid": "29746a27-5b12-456c-aa17-ae5dac31a1a0", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775044484, "uuid": "d6aba5f6-3340-4ac6-af5a-f229a4fa95be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775044484, "uuid": "5f4cde5e-807e-4c3c-a548-5602afeaa164", "value": "Purchase Order-PO66576.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db705776-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775060926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060926, "uuid": "6670e202-fb6c-4d63-90c7-465b704113fc", "comment": "Malware payload (AsyncRAT)", "value": "a77d883ece1dd996267fbd01349f48d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060926, "uuid": "3dff1c8d-919c-4e73-aceb-fcee783db0ff", "comment": "Malware payload (AsyncRAT)", "value": "cdde3b2650c951e774a8694208c0d151e91b40db5d21da3d790d88ebd702edec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060926, "uuid": "54219cb1-be2a-4414-9c90-7072cbe244c9", "comment": "Malware payload (AsyncRAT)", "value": "d48a4375db139a30d2d1e258481e406b230d3cf4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060926, "uuid": "292a1c65-f3e1-48a5-9b30-a2163cc9d785", "comment": "Malware payload (AsyncRAT)", "value": "3d27d2ec73b0624b178dee2d365c00d5660a65598176e32bd28ad84470b38364869241a2a974107d06021867ac9b124b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060926, "uuid": "deebcbf9-d36d-46f4-a8d8-8dd2a88e503a", "value": "T153E24B483BE48327D6FE2FF229B6910102759507D923EF5F5CD885AB6F67B8142013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060926, "uuid": "15a31c46-0ed3-4114-95e1-0a2b79cb36a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060926, "uuid": "5650b7c3-6e3f-48f4-8fa6-de5cf7a7974c", "value": "384:m7wTA+5OfPgEBQqWvfcQLZe3s80hYACSqR/inw2uRugtFuBLTIOZw/WVnvn9IkV4:IrgECfLH8MYAoR/iw2uBFE9RUOqhyb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060926, "uuid": "59d8e10f-3c95-4587-b679-163e6553cf56", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060926, "uuid": "e8521cc9-2bf4-417b-a33e-b8797026eb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060926, "uuid": "bd9996d0-d677-4060-a554-930cc7599ddc", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb98923c-2de9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775061839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061839, "uuid": "51b65f6f-3243-4cd3-a4ca-e642f2b4f604", "comment": "Malware payload", "value": "9f1890c90262b7902840fe36d88fa9dc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061839, "uuid": "269918b6-be17-439b-a009-7b8e763f2692", "comment": "Malware payload", "value": "ce5dbb526b359280876c6a6e7164c932b35af471c4370f90217393815d109895", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061839, "uuid": "5016fef8-e3f8-4492-974d-e25a530ede51", "comment": "Malware payload", "value": "1e6b65c50b058dfc94cf7bbc76c64337e1bf9a0d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061839, "uuid": "e789b351-4ec6-497d-a3fd-9005baba5364", "comment": "Malware payload", "value": "9db501a03cb22036a868d17deec1d5e7f46bb02526cb8a01a41d4672beecaca551a28edc1e58bc0f2a6fd00caf24ebe3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061839, "uuid": "6778912c-f6a0-4f50-b9de-29d8f3c79c9c", "value": "T19506D09A7CE044BAD076133689E256C1BF72FC690F3263D32A40AA383F776E45876754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061839, "uuid": "abd6766c-cf99-4a29-b4ea-5c9ba6f2f976", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061839, "uuid": "a5f93b43-b1b5-4412-946e-873f8709d359", "value": "49152:PbbPOxZ9X+O/wxUDv/BhBFEpJdRSv0lqfCGWEOvH1BHflRsI/y2oULTOfHrw4t:PCowwxU7bvEpJCxCWkH1JDbPoULqjrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061839, "uuid": "3f5f5fa7-7530-4d3e-892c-e015b943faf9", "value": 3853440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061839, "uuid": "59bc7a87-a9a5-4b9e-b5f3-ba80e9631562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061839, "uuid": "7bafefa8-1d32-470e-8135-59163416e7cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce49b83f-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053603, "uuid": "b2209d57-ba46-405f-b7ef-ef1fe23954c8", "comment": "Malware payload (Mirai)", "value": "3292ff0da65b31a07024422c43d559f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053603, "uuid": "4af6afb3-6650-483f-b2ec-3c9eacfa4638", "comment": "Malware payload (Mirai)", "value": "ce8de045874385a199fa6650b514893506c52c8a82dbeb654bcc7f3a84108c84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053603, "uuid": "7a3f1794-b1f6-4b6a-ab35-5434f182fbce", "comment": "Malware payload (Mirai)", "value": "93be493a7cb82d5d4030e05a8d336e1f4d552201", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053603, "uuid": "6810e712-82f2-4ae7-87ed-1d546683171c", "comment": "Malware payload (Mirai)", "value": "5c57a4ca83b08f639a6f1f096234809d87bd39c685280409fc668795b6e1a3f816c66df78821ec21da1f2db60f9ff696", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053603, "uuid": "4cb7eb90-e534-4222-9989-bf2f32896a51", "value": "T1A8C3E185BB6369D1C1A342BDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053603, "uuid": "fefe70c1-16cd-4905-b051-7e0eb1f26412", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnb:0OCDjXG9qTWywxlxTnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053603, "uuid": "dfc77949-ddad-4a69-939f-1a1349161741", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053603, "uuid": "2143592e-a627-4863-841d-5c7bec4c9c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053603, "uuid": "66159bb3-a785-4519-85ad-39486ba0d952", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1adff2-2de8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775061253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061253, "uuid": "060c13b8-5f3a-4536-ab59-db002b3e1744", "comment": "Malware payload", "value": "f71dc41c91ac1be833a27b7c8003da1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061253, "uuid": "90c5d617-f2ce-47c6-8ac6-9ae3978d9d22", "comment": "Malware payload", "value": "cea3d2d8c26bf27965247ba363cb8db2c0eaa5db75a9f21545c6ab161b7ee9d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061253, "uuid": "fe63485e-9a11-4c3e-af5e-c7603ac0604e", "comment": "Malware payload", "value": "949aa5179974a44c53cdf7a59887b73344136bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061253, "uuid": "960d95a7-3467-43f4-bcdb-cf2680f25460", "comment": "Malware payload", "value": "e3f1bc541db9f5c6a78a27981b5800bbef5111b11e54e0fe54a5b5a7a44a556a51e842fcb0d714edb742462acabd80a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061253, "uuid": "764f6f7c-7fb2-477d-99fd-50d034f53fb9", "value": "T1E9B39CABB24F1450C42507F51BCB679C2E3324019E2B9AF77C6E363E2A769DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061253, "uuid": "d8aa218e-33ad-4e66-a033-475d16def266", "value": "3072:KOfGwN/YA5+owRVQLBOlzK6smqTaNbgiCdAVil/02q3:KOfdSRRVaB0MNTSnCdAVi5q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061253, "uuid": "3b095441-f20e-4122-9893-ff015a846bb7", "value": 116152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061253, "uuid": "be95088c-e2d7-4ae4-ac6a-90336c1f90c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061253, "uuid": "bccbc5ab-463e-499c-baba-2f0274ebeafd", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ef76f-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775035886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035886, "uuid": "c129e791-f5de-4eca-8a43-5a1354ad7809", "comment": "Malware payload", "value": "3e231b0233b0fce425e7db8222d9b813", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035886, "uuid": "22260ef1-97cd-4aff-8d83-c5e502076aa9", "comment": "Malware payload", "value": "cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035886, "uuid": "eb440727-a14f-4679-8e4a-f82e54d8cb8c", "comment": "Malware payload", "value": "9a143d2b9d1c3c71edf299460d1be5653596b3a1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035886, "uuid": "2b156e5f-6a95-49ab-ad09-53755630133a", "comment": "Malware payload", "value": "7101cc1d1d0405e30055aacb0aa9da9692a508a969ea6bd5e5b0546f3da10abfae3b79371a5d6f1276449c45bbc959a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035886, "uuid": "5ed09a1f-0c76-4695-a893-2f0c6937e6df", "value": "T1B5F14135DD1A98139272D0AC4836E695F32607139AA29D13BAFC83243F75463CAF529F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035886, "uuid": "ae6bfda5-648b-494c-ad06-2c0873eed5bb", "value": "192:cL4e4fFZBw7ViVXbCHKYV2QBKy5p5UXMO9fBy:cPobC1VrKy5p5UXd94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035886, "uuid": "9bd8e87a-b19d-4ec0-b74d-9bed8a2d3f3a", "value": 7879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035886, "uuid": "752ce61d-4b7c-4e97-a041-756987c5f648", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035886, "uuid": "9df58ad2-3aef-4ea9-b157-dc8830406603", "value": "33244556546.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c7efd0-2d77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775012704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775012704, "uuid": "c81ee837-9940-4d97-9ac3-53a94e8d4af3", "comment": "Malware payload", "value": "047d6e3d43b10cdcffa8bdcc043e43b3", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775012704, "uuid": "a991ddc7-2f9b-4dab-a514-dee04414f4bf", "comment": "Malware payload", "value": "d059214e924aef387c75b1293a391c3a8ec292f65d3e654b5c771cc3cf1f41ce", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775012704, "uuid": "b5643c76-038b-4512-80a1-6c134ebd5aaf", "comment": "Malware payload", "value": "f5ddc85b9aef9e05244e87b5f16e7a690db04586", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775012704, "uuid": "7af0664b-375e-432f-b73d-61d72f4510be", "comment": "Malware payload", "value": "61b10c0683591d95425b945d5549de96a4a0d97b12af132cac0837b0c36b03076489b998edb361465784cb7d828bb817", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775012704, "uuid": "4c1ac617-f10f-4f24-af76-35d518c4dd77", "value": "T14364CE17EAF9012CF4FB1F46C2BE2494087AFD691DAEC4EC18151C8D4A61A49C9F2B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775012704, "uuid": "1f6c5985-66fd-4144-92b2-04484d128fb0", "value": "6144:nzJ+q3JNlXw5RUWLp00Xt+eBgPV9/dyYe1GI:nzM6XwMW5FBgPch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775012704, "uuid": "02531fb6-d39d-4e62-8f9a-21ec7331cf7e", "value": 307894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775012704, "uuid": "30cec5e7-730c-4211-abe6-9ec206914d72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775012704, "uuid": "781a8df6-518f-4889-84b1-3c51a388ec5b", "value": "NEW PO 699.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ce84cf-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080759, "uuid": "8cd8dde1-b312-48d6-8345-a31b23910499", "comment": "Malware payload (Mirai)", "value": "8077631d3b2f4d7f95d01e1cb4701eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080759, "uuid": "8aecfc95-c2da-4cdc-b9fd-4f62c0fc287a", "comment": "Malware payload (Mirai)", "value": "d1a53244765468be07bea9b080d68e3b3d167864ab190deece9ee36b15b01c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080759, "uuid": "24588b69-afd4-411c-8173-ef1401822b82", "comment": "Malware payload (Mirai)", "value": "68288ec419e31ab6c5208014f87ce577ba2b4b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080759, "uuid": "368b812c-6d99-4281-8214-c3902aa6031f", "comment": "Malware payload (Mirai)", "value": "4337e8d57d776d6d6e9367fbc68cf4f32ac2356a179855f2d78a6820140b9d5f923148a932950d724aca7ac44cfb8032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080759, "uuid": "886a2b1c-4a72-4a0f-9740-eb1ba2b07a53", "value": "T1F064F95DF8809B7ACBD0627EFA9502CD33334F68EBDA710589356B3837D6B25943A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080759, "uuid": "718cc83c-66a4-4df8-a91e-bc033d7f726e", "value": "6144:rKf2dv+0o44xn7YZkpJ3xTJvydYlkDMsS6z5v62WAgKmR860MkLBGCGHt+k4qm9v:mekpMpS6zr6/EGNPH4hQTXdmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080759, "uuid": "cfcabaf1-2528-4423-82b9-af077d7fa689", "value": 313420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080759, "uuid": "8d0007ea-7366-4029-a4ac-52a90e67d46a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080759, "uuid": "8a57671d-2d30-4cd2-9cc1-d99a0001c62b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bd3542-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057400, "uuid": "8e6fa965-a222-45cf-a79e-0374c4e545cf", "comment": "Malware payload", "value": "c2eaead43ed3fadd2a6f98626567a238", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057400, "uuid": "e4de641f-325c-41b3-bc97-388d95a807f9", "comment": "Malware payload", "value": "d2011ed4fe2998724e3312174be8f32f65f858ddcd1f1b40ea3ac0806c007d9f", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057400, "uuid": "baad22c0-1122-4a5f-b9b7-b686d1d83103", "comment": "Malware payload", "value": "a01f470a8aed5aab28f54b66aeb81b8df0c4c1b3", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057400, "uuid": "6503d043-8542-45dd-93e7-49962d710d79", "comment": "Malware payload", "value": "fb7e7ca6e74cff109b38c4a16e1a2fc15eb9a2693ce155206c4d90340fa254bd62428b5b4ae531bd606d1d39777501ea", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057400, "uuid": "2760eb8b-81b4-4a13-91df-8c1da81d0422", "value": "T11754DF45F7EC5209F8F65F1179BD60824C36BE626D2EA8EC14140E4CC6B1B89DCB2B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057400, "uuid": "8aa84c7a-31ca-45ca-b0e2-203269d9dba9", "value": "6144:6crHGu1KeWkk/NDWBmhf3JASdX+bsqJpln9RWka/Nu2CgC83qg:6oBPUD553KSl+7pNTraVu2R1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057400, "uuid": "3a570f53-93f6-423e-879f-9a358ecb1d2c", "value": 285232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057400, "uuid": "d1debd17-7649-4d7b-b420-071533477df0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057400, "uuid": "fcf4144e-a60d-4dcf-81cf-d09b2be45131", "value": "fedex_tax_bill_document_receipt_payment_31_03_2026_000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf2791e-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775057600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057600, "uuid": "a88925cf-6f0b-40ce-9ad9-8ec25672c0a1", "comment": "Malware payload (Formbook)", "value": "b037c0f941396484337e049fe9ab017e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057600, "uuid": "1344fb23-fd4d-43df-afd8-bf8cbcb166c2", "comment": "Malware payload (Formbook)", "value": "d285d4d5975a8e8af2d3b7b6d96ece1b751addaa9a72805dfee16d32dc9aef66", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057600, "uuid": "e5874064-098a-4c6f-b583-0092bf38812b", "comment": "Malware payload (Formbook)", "value": "dcc6936b58105a738e6c16461e163e076ba0f809", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057600, "uuid": "66a23708-5e2b-4756-94e9-72db5248f842", "comment": "Malware payload (Formbook)", "value": "5eb43a06b3165950da2856a8fb6031662a5ee53142a0d9bb40b325b155ebb32103e3c1a75e2f2b129b2f94647df821df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057600, "uuid": "a6fdf8ae-5398-4d92-8706-4df994541b0d", "value": "T1B7746A0357FA4518F1F74B98AA7B40A14AB7BE5A2D39C06D11A9144E0EF3E18C8B57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057600, "uuid": "aeb63430-9c2c-4fb3-b6d2-e1e2543ffa06", "value": "6144:AE0WCaheh41zX1kQDLy9/mcWikLOCjyao9rUkmXISt8u5kN3nJ3yRwA3144WpfiA:X0W5eh4tlRDLy9eRLD2IkmX2N53Al44c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057600, "uuid": "735b0a2d-c1fe-4949-a490-4029cc626d7e", "value": 366992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057600, "uuid": "8731e983-73be-472c-ab98-1861f029c5e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057600, "uuid": "f7413ef2-f020-4adc-a887-5b8023ffdeba", "value": "PO2026033046789644.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68938c13-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775046560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046560, "uuid": "09272dc6-7d95-4b75-a0be-29501549be61", "comment": "Malware payload", "value": "bd0d90794a93b29eca06038fb49251d7", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046560, "uuid": "e4f245b4-835e-4ca8-9cd3-66b9b14595a3", "comment": "Malware payload", "value": "d2e8bdf1cc427f6311d2ae6561ef78e5f52ea7f79ab8d14ed352fce401e3d353", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046560, "uuid": "d7f25c25-90dc-4067-a2e7-9fda10793bd5", "comment": "Malware payload", "value": "e0d9fbf13eee08984bb236354ad7be252f184b87", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046560, "uuid": "1e5f5420-852d-4099-a0d4-d1c1a8350ece", "comment": "Malware payload", "value": "1afbbc46eb65e50d9a46372ceafd0c775b459ec50eb3606b2d1117214a6934d89d013ad17dba561f1e5479a1e6018f69", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046560, "uuid": "5dcd2208-1316-4a77-a4ce-b8ef8e2ca61e", "value": "T19A33C7E01E5D305221A324F4CB3F8E629A7DF07E3A4742E09924DB13B26F866ED6D51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046560, "uuid": "07e4e4bc-48ff-4a80-918f-a3e98afcfe5f", "value": "1536:DzOhfwJP+3CViV2kpO5Y+YMw5QwszFttWvQ7iGA1u:DziwJ9rkolYMbPzFvX7iGA1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046560, "uuid": "60f5de24-0bce-4bb2-b0c7-568be24b0473", "value": 53098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046560, "uuid": "cd3beca3-66ff-489d-b78f-71f535dd7a32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046560, "uuid": "bbe5e969-1cb5-424d-9fa1-d0b2052643f7", "value": "d2e8bdf1cc427f6311d2ae6561ef78e5f52ea7f79ab8d14ed352fce401e3d353.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3082d225-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028427, "uuid": "7a59328e-551f-48f2-901d-2f81b7873a64", "comment": "Malware payload", "value": "b728c9da6f770da7b53baecc0cade8fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028427, "uuid": "b1ff0adf-9c48-4f47-b5e1-96d80d79c6c3", "comment": "Malware payload", "value": "d41757c87c22597f4d14406a356b50022cb9a6dcdd9baf0b7075d4fcff3bf774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028427, "uuid": "33716812-98a2-420e-aa6f-ae334a89eeee", "comment": "Malware payload", "value": "a680495c70ad00792656878769b0a8cd874d111a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028427, "uuid": "d4d4af95-17ea-451d-84ba-e4fd268c7310", "comment": "Malware payload", "value": "2bc998c116761062af7d131cbf33c02fff7c00ae0caa66df4386a85e0cbf7a81b73c99835b7d74864a57ea6366221ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028427, "uuid": "429e8c77-415c-469d-a29c-f10336187edf", "value": "T1DFF43CB6DA974A79C37E17B6A7B3CB019731B431531231C3E264B1940AD22CAE376E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028427, "uuid": "c5d4238a-02ca-4836-915a-d5a2d300b636", "value": "ed6995252233cf4738b93938aea3a531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028427, "uuid": "c22a0740-0fd0-4258-98a2-c0c24a56b624", "value": "12288:+HnNczwGNUbTsVKNdD0M4oXJOHxV6kKBIT2gLSKf/jrXNNy+t8aJFAHihNEEEOVq:KnNcCyVXKBIT2gLSKf/jrXNNy+t8aJFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028427, "uuid": "6ad71683-ea72-4d3d-81ce-f564aa38749c", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028427, "uuid": "eecd9172-beba-4473-b742-6e74a6a9fe61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028427, "uuid": "cf75f776-8430-466c-bc80-5c84c2d13d0c", "value": "memorydmp (4)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6bef7-2e11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775078969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078969, "uuid": "cd3fafb6-08d3-4fd0-b51b-93272a5bdca9", "comment": "Malware payload", "value": "bb54f67bc586a60b082bd0e18c592e4c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078969, "uuid": "17dd32d2-f099-41fd-8570-8298484d6425", "comment": "Malware payload", "value": "d433c3bac9f95f95f3c944481d67f63ed38f5abfc16617f620c5a580f8bd2b08", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078969, "uuid": "2b0fd6e5-70f7-4997-a9ce-d236b0887840", "comment": "Malware payload", "value": "96873d9396607453ce68602cb2ad98f227761794", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775078969, "uuid": "90120bdb-9a96-422f-b10a-15abef8987b9", "comment": "Malware payload", "value": "894b90a8531bb6d1c41a5b0fa6e578ed12740760c3286cbc40595e71c497ba4058e8ed18bc0775528f0290b8a800d293", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078969, "uuid": "dad0b15d-835a-451c-9645-b1467a01aa99", "value": "T1AE46CF32F502A035ECF320F3A3BE5BB54965AD142B2594D3A1D47CE496719D322FA38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078969, "uuid": "f535b878-45f0-4198-ba3a-036d07ec3507", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078969, "uuid": "b0058658-018e-4851-8abe-da0c88b58201", "value": "98304:e0N51GxhiehH7MZcniemm4FjC74fgftozP/DELJfWR:eCPIUZxK4fgfEPrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775078969, "uuid": "1ce0b1c0-c618-40e9-b0eb-253878cb2923", "value": 5447680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775078969, "uuid": "058473bf-7d7d-4d1b-9811-e5a130cc2c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775078969, "uuid": "81d9d42e-8b87-4144-91b2-f7919381b1e5", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba882f5e-2dfe-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775070749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070749, "uuid": "87286be1-3afa-4a29-a08e-c11fe19b8832", "comment": "Malware payload (SalatStealer)", "value": "33bcd7ceded722537581b6c597ed077d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070749, "uuid": "5bda5509-092a-4358-a132-72ebbdd67853", "comment": "Malware payload (SalatStealer)", "value": "d43532c0d01e7130c5f04880e73ab7358540357f3967f409c93093e8087874cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070749, "uuid": "133648ae-8ed6-43be-8954-95d04a0746c9", "comment": "Malware payload (SalatStealer)", "value": "cd18954825f07aff7fa9f177b4937201944312f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070749, "uuid": "775c27c4-ac67-4723-b1e5-9a540a939693", "comment": "Malware payload (SalatStealer)", "value": "f83f8508b063b5045a932c4e4af5a89054cd40248585824301ecbe42f9255d1df561447fd2c99a5335def461beaa5731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070749, "uuid": "d4e243db-0e2f-4cba-854d-f3a893412e9a", "value": "T112C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070749, "uuid": "db064e54-ed6b-4a46-a623-b0214f42a37b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070749, "uuid": "b332fb3e-3b60-4b59-9bdb-1b9fda0a57aa", "value": "49152:VpXZKft05HtyvruRo9JBDRHCTdU391KX1NbNV4L6d+NTPeGFPbQuhHEPAw8sWegp:DZ0tkRorxxCO3ukFJFzAo4f47eEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775070749, "uuid": "e8f85189-b408-4d95-bac8-bbd9fc2be05d", "value": 12570624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775070749, "uuid": "0f366162-be70-4a59-a4ec-fc2786f7e7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070749, "uuid": "c319b83c-6a92-47cb-8c00-4a256b582ef7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b89348-2d92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775024163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024163, "uuid": "d4b7d5a1-60d1-4031-bacb-2f3ebc400c9c", "comment": "Malware payload", "value": "04e9bfd280ebd559449d00916e9a89e6", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024163, "uuid": "afd5eed8-c1d8-4424-b9ac-7896817b67f9", "comment": "Malware payload", "value": "d46e4d990430961f467f8147561c0d207246a54e5bdc8dcd8eece62894f6f581", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024163, "uuid": "25a4f239-8408-44c6-b226-385ce1f6eadf", "comment": "Malware payload", "value": "d6b34a2d79f41f92225eb3be4db58bb6f8a8039b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775024163, "uuid": "4cc8a522-9acb-45ca-834c-bad6071b7d1a", "comment": "Malware payload", "value": "180208f5c4782b35a0b5f4bf343c7a4963838b1294f5ba20565d0f00f89862f2c72b3cb4fcf32ac13bb10e43489c19f6", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024163, "uuid": "3830efbe-c22f-4b66-aca2-7156c48ff6bd", "value": "T129D3E2CA5D8AC5A48B6F286C461F5D479A8EE123021DC880BFED9F883F116F0757E8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024163, "uuid": "68f1dd36-0449-4948-82ac-89544791260c", "value": "768:q6e7yjUqqMfL2gahV47BtkktNwbI/Scesx6X6w686v6/e1d8KhyIE1AMaTfa/c9Z:YufvpjX3pVrj0mZw3sq4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775024163, "uuid": "aa523db4-5d2a-4ca7-bf79-e61908181440", "value": 138201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775024163, "uuid": "8849714a-503e-41f0-ae8d-fbf9c83a647d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775024163, "uuid": "29f5b570-9533-46d8-8805-23b4b9b91e84", "value": "Journal_Tokyo__58.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0908db-2d75-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775011827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011827, "uuid": "c1411b46-d41c-4a41-9d8b-86ac267b2e42", "comment": "Malware payload (RemcosRAT)", "value": "12252e324c5c6de031900ba0ba369231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011827, "uuid": "5c58e709-d4eb-4490-8092-07347973be33", "comment": "Malware payload (RemcosRAT)", "value": "d50e189d3306616047d9b438999ffd2810967341e2bf8251b073f631939dc3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011827, "uuid": "468d8285-a2a9-4474-9113-20c70c2b464d", "comment": "Malware payload (RemcosRAT)", "value": "d2142f89f856f3210b0283f26b6377b77dd643d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775011827, "uuid": "399dcb9b-4559-4ba5-acd7-2e4e7285d667", "comment": "Malware payload (RemcosRAT)", "value": "6a79f053f1a6572988b91123f5639ddd68ea0f67ee47a285a0fb19d7a4932e60988ab5272a540424091e3647321c4d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011827, "uuid": "8ad78e5c-a328-4d34-9a55-5bb969e202a1", "value": "T1C6B4AE01B7C2C1B2E57218304435E778CEFDBE2418359F7BA3DA1D97EE78150E6296A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011827, "uuid": "9386c9d8-5333-41cb-804c-104978333dc5", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011827, "uuid": "103c56a7-baec-4bd4-9a57-090fc3d13db4", "value": "12288:8bvnxXGyDuvystCVFGNgiFsGJsvvg6sPZs1:8bvxXzDGhgiFsGJsvvgZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775011827, "uuid": "852c34dc-f717-4a76-88a9-f6f37a53c3e2", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775011827, "uuid": "5eb49028-d683-4a14-8c5f-d5566ad8ed9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775011827, "uuid": "4ccfa6c7-7cec-4cf0-997b-5bd29590757e", "value": "12252e324c5c6de031900ba0ba369231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c1739d-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039288, "uuid": "2718e67a-66d5-41c2-9163-b116b632da06", "comment": "Malware payload", "value": "4a68e3dcb833f392cd1d283dd5539677", "object_relation": "md5", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039288, "uuid": "daf6d67c-d43d-4d06-8533-de9831e4c857", "comment": "Malware payload", "value": "d665d6cfe484c70fd7aa66fbb2cc050a2d1d3ec7a8d524e745bdd3e534913c15", "object_relation": "sha256", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039288, "uuid": "5df0ae3d-ca5d-4778-834a-1a19b7ad5c7c", "comment": "Malware payload", "value": "3d7b9128b6aff86679e268dc298a8e45fe337765", "object_relation": "sha1", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039288, "uuid": "2137cdbf-f9c4-4ead-8826-6e6f94371a5b", "comment": "Malware payload", "value": "3153de34cea8025abb777ecec4b19d3be453c9ee307022f243739051e1e0e44e5f06f3df8275fdd8a88f4e23e1532e16", "object_relation": "sha3-384", "Tag": [ { "name": "miappl-com", "colour": "#29CC01", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039288, "uuid": "a2b3975b-a5e8-4615-b9f4-e204f3bc3fbd", "value": "T1784144F2B6385830734E90EDE95471B2B8534BBF05A9BE80F0E29F4C061D56C10767AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039288, "uuid": "b0ab33ea-478d-4f47-b2f7-7532d8f9a53f", "value": "48:2HjKZ+DF6205Mlh/WLzoNuI6tz4D0J0yQO4s:2TD9a4/Oow9tz4D40LTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039288, "uuid": "09a977dc-6d06-44a2-b0e7-dfe70028c5dd", "value": 1908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039288, "uuid": "8748a38a-7bff-41b1-8682-1c40d64a2068", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039288, "uuid": "e2335ff0-6a2d-4e9a-8bfe-b63fce64aa67", "value": "d665d6cfe484c70fd7aa66fbb2cc050a2d1d3ec7a8d524e745bdd3e534913c15.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc77fe88-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053600, "uuid": "24f0bbc4-677b-42c4-b97c-64e9b268fa61", "comment": "Malware payload (Mirai)", "value": "a48158771cb80d09617fcc986bcbe071", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053600, "uuid": "bd81ebec-c200-48fc-9670-3af88ec97ad7", "comment": "Malware payload (Mirai)", "value": "d72aa8b312077ef515ff412ce72dc38691ff6de07238c81e0dd5e67ae5424bd6", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053600, "uuid": "79e097f3-f780-483d-a6e1-8764540c09c2", "comment": "Malware payload (Mirai)", "value": "9a4ae95e2a10c4f32c756c4ffe72f8b32bb4136f", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053600, "uuid": "6d1085f7-b4fc-4306-a0b7-479c3e8ffd3e", "comment": "Malware payload (Mirai)", "value": "3a265599374d4f4977b4b554b152ce78ce36b064b06beb3ea4fbcd9b7b4b0c0faec21b9bfdce0c53d1e45ee37b0c6d73", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053600, "uuid": "055c0699-b540-470b-a507-243575b5994d", "value": "T191631246FFCC1F9DECCA17B507BA62CB2311603194B341F81DE69D86855FA6220AAC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053600, "uuid": "2a157da5-eb1a-4e16-94b7-6edd1864f9e1", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDg7AvrPL:47Mbp2L+Xqdfoz2sBrPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053600, "uuid": "06ecbfd3-38f7-4c55-ad02-5dcf61b9a16a", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053600, "uuid": "98729576-6e84-49fe-bcd7-37134891eafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053600, "uuid": "7b330a7c-2bc8-4a23-81dc-a8060ba9622c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c1cdca-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057747, "uuid": "3a979ad2-65d6-4cd8-b66e-b747ab7be662", "comment": "Malware payload", "value": "c922ff6347378d2f958edc7ccc95511d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057747, "uuid": "be5804f2-3a15-458d-8b18-1426eaf65903", "comment": "Malware payload", "value": "d7bc9c3b491752b756167fb0a78ba5cc93085ed7d9573fa88f1f31b14ee4ebd3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057747, "uuid": "73fd10d0-22db-4fdf-989a-76947eb81d0e", "comment": "Malware payload", "value": "ce02e4aef4c1a982d4ea06f29417183ee3486e72", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057747, "uuid": "12c3fa1b-4e15-4367-9ea2-08f16cc2c880", "comment": "Malware payload", "value": "65d6439edafa589afc12b96e16d35bed9e69776b4627f153affffabf5e667225abde6f7b63af470c054b06e25de8a046", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057747, "uuid": "1faa7d73-8ba7-4b5d-8e8b-8e689912f38f", "value": "T10054E098E3CD1104F4F38B69EF79A581583DFD126A2EA4CC09241D5F4B78B8895B3E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057747, "uuid": "98b7905c-fc97-4209-aa7b-077b616d5315", "value": "6144:Ml1vRwZ8yrqi5Oherf9bliE3PKZ/fP+YFwmqdE1kgQ4YEKfvJVy6GREQy9oxkJx:Ml1vgjrq+OqfxlvInFodCkgQvfv7ylRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057747, "uuid": "6b223050-0af2-45e7-8f57-466e5c97fe06", "value": 305778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057747, "uuid": "8d135476-c799-4837-a591-c9981be61072", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057747, "uuid": "2c4ca319-b831-4e59-967c-fd88f7b7211d", "value": "NEW PO M208750.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a516cce3-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1775028623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028623, "uuid": "7dc66c91-ab16-4a8a-8bcf-1cff7d19c6d5", "comment": "Malware payload (MassLogger)", "value": "78f3519749691e12d10f495615b94ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028623, "uuid": "5df70cef-74e6-42e0-a814-b1d4cc7876c0", "comment": "Malware payload (MassLogger)", "value": "d83a5731392da27f2092430ba3c9f0407593ce08397060ec662728be0e23c6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028623, "uuid": "c4ca7a7e-8350-4cb7-8fb8-74be18dce153", "comment": "Malware payload (MassLogger)", "value": "97d01a92bcbbca56ddf614879e9831879067f92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028623, "uuid": "2134a6b3-4e5f-4015-b059-1d34ed61b342", "comment": "Malware payload (MassLogger)", "value": "76e6ae5b4a6dc91d9ffaf4caef9fa2caba9d3941a7d6572af073ae468d7556b09873ce74bf699b307c85c1448e3fbaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028623, "uuid": "cf7ee301-3823-4965-8a8c-06f816da1445", "value": "T1D41501502259DA02C9932FB40D70E7B847B95ED9A522D3039FFABDEBF93D7067904242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028623, "uuid": "5bd9a4dc-237b-4b9e-962a-47b5f014f458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028623, "uuid": "c93ec212-cdfc-4e3d-805b-69edff336b34", "value": "24576:nSJJSHw3LKVe7Pk3lJSc/JhfNEST9Pn27z:nqUw3LKViPAJrFvPny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028623, "uuid": "1d36b526-3ce5-468d-b2d0-0e966c81d377", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028623, "uuid": "754eb019-eeea-4dea-a04b-6dc31abad600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028623, "uuid": "f9eece41-8f27-41d6-b40c-cc33b737155d", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80d2a85-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkWatchman)", "timestamp": 1775028628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028628, "uuid": "3d857661-afb3-406b-bbea-ed17648708bd", "comment": "Malware payload (DarkWatchman)", "value": "26982eac2058678ba97f4ba8f0831486", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028628, "uuid": "8c05e5f4-459c-4ef8-ae2c-6caadaaa1869", "comment": "Malware payload (DarkWatchman)", "value": "d885a1c36b75c4594b020cf7a45ae6f3cd8239af066843836fddd9a0fcf4fc7a", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028628, "uuid": "41d26600-e47a-434d-998b-f750b00329a2", "comment": "Malware payload (DarkWatchman)", "value": "ac305815c2d752277609bfab31ba61ed005589fc", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028628, "uuid": "60fec7c8-8acc-46eb-99cd-32260a58f7b9", "comment": "Malware payload (DarkWatchman)", "value": "9fc5d9bfed0fb13db258e0e88944462dedfd11505b5e02e85a62212d38611719e40004d0e0a43e4fd8532286626daf0e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028628, "uuid": "0dc056b4-5b40-4170-a4a3-713f7460101e", "value": "T1E1D40A92E284C5AEC4170176DC3AEA712527BFA94974861F256D3D2B76B3383107BE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028628, "uuid": "5008ba4a-2d17-420c-8c86-6da404da4f84", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028628, "uuid": "c1be13dd-a582-4c44-9a69-21aacab57c7a", "value": "6144:zOYGXaPNxdgSdcq2pVZPOJHAbK/qAoMGGGGGGGGGGbGGGGGGGGGG6GG/DGXxeXJk:HGqN/XdctpVtkPq2KHjlZ9IdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028628, "uuid": "f261c46c-4764-45c8-93ce-99f3df9e65a4", "value": 604167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028628, "uuid": "a65feec7-6216-4415-91b8-c4af78303f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028628, "uuid": "fba6d3c5-adc0-4088-9404-95017783a3ea", "value": "\u0414\u043e\u043a-\u0442\u044b \u043e\u0442 31.03.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92067946-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060803, "uuid": "897f4b13-6da7-4918-b236-abfa9bf1cb67", "comment": "Malware payload (XenoRAT)", "value": "0150a74b5dbc01a5712abfe00929f141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060803, "uuid": "ed20a5e6-cde3-4ad9-906c-c11c599d4847", "comment": "Malware payload (XenoRAT)", "value": "d8ab2c449c1cbbed108a3dcd28d82a923535ffc33036c205808f52099d097d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060803, "uuid": "7cfd901b-00d4-482c-b5bd-540d125c66fc", "comment": "Malware payload (XenoRAT)", "value": "8738d8d8ee6cfb7218ca8f22150570d5f80ec4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060803, "uuid": "80b3e7eb-b6b9-437f-b4e9-20285dbc6338", "comment": "Malware payload (XenoRAT)", "value": "375a75a6e59174f067d9b3c816224200c52999a9ae15a00f3a996f94a29bd1409b6f1d1bbacfcbc4947c67166fbf21b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060803, "uuid": "a1601e46-22e7-44b9-b89b-e7d6323d0ece", "value": "T10EB30B6BF6C49707C949C5388D27807A66E3651E12E3F226006B6CED3DF23F9674721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060803, "uuid": "696d343e-96d2-42e1-add4-9d04f5e80b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060803, "uuid": "8216bbc4-7509-40da-9207-60b9e5c1610c", "value": "768:odhO/poiiUcjlJInV9SH9Xqk5nWEZ5SbTDabuI7CPW5iZ/YJ:aw+jjgnVoH9XqcnW85SbTOuIuYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060803, "uuid": "5db1e90b-824c-41ab-9be4-f617efd357e9", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060803, "uuid": "62c6b4b4-e5bf-4176-afce-0775c4961ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060803, "uuid": "3951f265-f700-41f7-a1c0-b8de7f11a05b", "value": "xwxa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bec7509-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775079986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079986, "uuid": "63e30339-b4ab-47ff-87bb-03bd7560007b", "comment": "Malware payload (ValleyRAT)", "value": "15e8ed419218216fd0b53ce2c654183c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079986, "uuid": "1fe01876-a02c-45e4-a518-00b40cd723e8", "comment": "Malware payload (ValleyRAT)", "value": "d8cc8d586cd3c1fc102fc882c901e0a53c0809747121a061202d0294bb1a2b75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079986, "uuid": "218851d6-5bf4-4fe5-b945-3c457fc3b889", "comment": "Malware payload (ValleyRAT)", "value": "70bd520865ad914b4a9271cd46c00deaab96a881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079986, "uuid": "efc2db7c-db01-47aa-a88a-f1f5b0c25e23", "comment": "Malware payload (ValleyRAT)", "value": "bc26871eddf7506a041f0601a231b7eae0e7ad4bfef337a069c621c87bbee2f385544e0569881bd19bfceafbf79a113c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079986, "uuid": "64f4f115-11a2-4191-b44b-dc163d21edaa", "value": "T1FCD5331AF76977E9E06F413E8492654AE37778310BB0874E131842F22F175E49E2EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079986, "uuid": "31c63f21-f856-4595-bafb-8d94bc0d07c9", "value": "57aa5a06514e2fc2ce3dae5b3cadf0b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079986, "uuid": "421b20ac-d095-4528-886b-30ebcc7aad4a", "value": "49152:XWM7XgF/L4vNq6b7sP38iH6YKfBIxucrQQsyKlZDDeZ1X3zwjrSGnz+uC+Mh0eWJ:XN7XsWy3p6YKfBTc0QsLDeZkKQMhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079986, "uuid": "5da58e16-1988-4ae8-bd9d-a18297c8fc6b", "value": 2927104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079986, "uuid": "dd4d7927-2978-475e-8fd9-ec16339d2d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079986, "uuid": "d521aa1f-c6fc-4f08-af7f-639e0385d096", "value": "\u9ed1\u56ed\u533a\u53ca\u6b7b\u8005\u8eab\u4efd\u4fe1\u606f\u8be6\u60c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da9a54d-2db1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775037522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037522, "uuid": "a88cc628-b7ba-4158-a3b4-626b31430827", "comment": "Malware payload", "value": "4b29686394d84bfa49e6b838996f7573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037522, "uuid": "ed09003a-c08c-4252-bf8f-d6e9951c81e1", "comment": "Malware payload", "value": "d8ecbb12c70c8cb2c6ed41eb6e5c528d2824f6ab9e4316709153563883d03d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037522, "uuid": "d6662e30-7fe2-4fd5-9c44-99e7501c5406", "comment": "Malware payload", "value": "3acccf8b4f3a213b9246bc393a75bed5b6ea5bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775037522, "uuid": "515e8b84-64cb-433e-8aeb-82a7afe09e59", "comment": "Malware payload", "value": "080525e72af3cde7a19fe7b7dc70c5dd857fc4fd492eedba17e622092bd22d5969c37df6b0fa9bf29589d1e11f7e8f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.mardom", "colour": "#02342C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037522, "uuid": "305c2651-6215-4bf6-853b-abce548e743a", "value": "T196C57CF0A195B840F407EA7AD4CC0CBDAEA23BE1707B4940E6B75A056DA19F1FDC81D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037522, "uuid": "882557c4-4df2-4f5e-b503-a120bc588379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037522, "uuid": "a7ba70c3-3624-4860-b26a-6e87187fe824", "value": "24576:7xfQEPsJeqlDS7urPboKymKqelg1xWbjFduTD3SyOAAmS0dUFEV+mys:tQEPceqlDHIXZqjxMFA3mF9FEVis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775037522, "uuid": "2b8b28d0-314a-4d4a-a8de-2aca8296a7d2", "value": 2683096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775037522, "uuid": "b9f35659-0dc3-4cde-9b9a-91ccccadbce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775037522, "uuid": "7b56561f-6602-40ff-9017-835cac7bcbc1", "value": "BorshFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada3f430-2dae-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775036368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036368, "uuid": "e4830ae1-d81c-4efb-a1c2-4cf3b77227c8", "comment": "Malware payload (OffLoader)", "value": "dbdc2b7ad2c7c824cee959805cebc803", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036368, "uuid": "d1402ace-f415-4f4d-8590-d625bcab7628", "comment": "Malware payload (OffLoader)", "value": "d94f6db91851553d79342d6c9f1a40f2e02f7bc38cbca9df639238e2f3e8fddd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036368, "uuid": "eacfbdb7-63db-4c59-8c06-0872988dc68d", "comment": "Malware payload (OffLoader)", "value": "644a974599aabee75d7e4c6ecfe7c251374b0ef3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036368, "uuid": "04377613-1c7f-4d93-b2f8-8ac1f8d1fc1f", "comment": "Malware payload (OffLoader)", "value": "fe6d14cb0ab8e96037bc1adee724ae562f038b8f7dcc91d349a159dbf9f477c57d4076c147e00ab503005013d1946520", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036368, "uuid": "7dafea54-3d05-41ff-b0c1-33ec3e5a6dfe", "value": "T1B4460233B24A633EE07E163B59B6A1605D3B7A21A51F8C46A6E44C4CDF7D0A01E3F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036368, "uuid": "481c6479-96ee-47dd-9752-784aa114b8b1", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036368, "uuid": "fa9cbe27-04a2-4885-871b-069173cbfbea", "value": "98304:SN66UEKTfxPWCIYlzi5hxZWPjUvTYZveJl3JcZitqXsPa:6UEKjxPWCIWzirbWPjuTsGJl3MXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036368, "uuid": "7040ee73-59c2-49d7-b335-896572a9c29c", "value": 5764046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036368, "uuid": "60f173c7-8783-441b-909f-7d6c59fe0e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036368, "uuid": "1eb67767-67a3-43f2-b0d7-ee95eadff813", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f31bab-2da1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775030819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030819, "uuid": "2fd91993-6b16-4f84-a96e-f1bb5c9475ef", "comment": "Malware payload", "value": "c223c3d0d5b9d75b14aeea113cc1b0b0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030819, "uuid": "6d1cf3b3-462c-47d4-b496-9c8e03c3fc26", "comment": "Malware payload", "value": "d95a272102d015f60aba2a2d39f3e62205f07a9bd28f15e884bda35bfc658b00", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030819, "uuid": "8f62db05-9130-4f05-bcd4-409b3318053f", "comment": "Malware payload", "value": "3c33dc5743d20aeb13989209dc4537c06002872f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775030819, "uuid": "b9f511f1-60dc-496d-a63d-030c3cce902d", "comment": "Malware payload", "value": "66d88c004d2b2089b8700072474b57b1fe47e65db3bc1f91e8bb5a4a0f305becd8aa7b5cbfad7fbbd70c34d86c2fbdff", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "qpo-smoothfacing-cfd", "colour": "#157D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030819, "uuid": "ddbdc143-6c72-4027-88cc-f88e763e8359", "value": "T1F27733C4467CB8FE943EAC67EBB9C7C784D4E112E4E211DEB13450896177BE427A8362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030819, "uuid": "58cebc7e-4742-4e5b-92f0-861322d41f3e", "value": "786432:k4f9+VEq0Jcl/lm8FLFfcd1XWmMg2nbUnxNXD6DG5ldu:kNeY/A89id/MXn6xNT6Dylk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775030819, "uuid": "73c7f986-cf01-49ac-b466-e9a126277500", "value": 33997419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775030819, "uuid": "46e89b49-38db-46c5-9dca-6f641764efba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775030819, "uuid": "393f8ee0-e3d1-4a78-a589-3523422c7a92", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4950e957-2e13-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775079579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079579, "uuid": "0a9a82a5-be2d-46d5-9b73-421323318b2d", "comment": "Malware payload (Mirai)", "value": "0a62b1440fdfdd722729939fb8ccc16a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079579, "uuid": "355f51ba-3562-4c35-a133-31ecb11a50c9", "comment": "Malware payload (Mirai)", "value": "d968cc965bf4e5737413f4d730dbaac7b27ad8fb30beb182bcf6ed9af8811ff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079579, "uuid": "2b5414b3-acd5-4746-a526-e5bf1500929d", "comment": "Malware payload (Mirai)", "value": "e3ade1bea5a649f9c309c9e0816bff6a8ebf8077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079579, "uuid": "9abb19c3-7c58-4098-a07a-2bd097498be5", "comment": "Malware payload (Mirai)", "value": "f2ecec9fd59ac1cfa29cb66facc4bd26114c13a1293fe3d8f8dedfa90f9f6d716efdfed51c466e7c35949e34527d36f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079579, "uuid": "38d7c91e-2839-4cbb-aa22-07345c56c57e", "value": "T12AD22B0AB901452ED9C614BD601BDFA99FA563C1B283160B1BF8FE933C7322A7F11D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079579, "uuid": "16d87a32-7b22-4b8c-b22f-fbc7124be7df", "value": "384:0bksdWGKXtIbWUxRFBgqai3UGrfFoqIoodvO8u/3hO1Gau4p:0bZu7yba2rtfUEvhO1GauI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079579, "uuid": "9f263e99-038a-4b86-9932-09e7329cca79", "value": 30576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079579, "uuid": "a6caaacf-2064-40e4-bf5e-5ed5674ad17c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079579, "uuid": "18340e88-7351-43c4-9acc-101083dbae20", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971df551-2d8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775022157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022157, "uuid": "4abb7cfa-cb4e-4fc9-a3d9-2a1f1c2efd39", "comment": "Malware payload (Vidar)", "value": "55865274d2a400d47fa87422912d5971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022157, "uuid": "a8abd649-0e62-4184-9c9c-9c14786efdac", "comment": "Malware payload (Vidar)", "value": "da1f48e734cb4d49d985552ffb3fe7713d324b3cffcdbcc3e324049114f5aea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022157, "uuid": "2672db17-efff-47e3-8db2-b3e53778751c", "comment": "Malware payload (Vidar)", "value": "dea3b0a1ffc496f9edd553937f7fb2ca6f0167bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022157, "uuid": "aa88ac4b-de10-4ba1-82ef-473eb6db7e52", "comment": "Malware payload (Vidar)", "value": "3688202519197f08f2ea018ca79aacd4ce22eea98bd699003f418d5a7a0f10a73a656368af57ebe66186ed2903e733e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022157, "uuid": "02d1e6ef-8303-4f1a-a7ba-d0c5295ddf5c", "value": "T1ED958B4B7CD185BAD06BA33288B65281BB76F8190B3233C32E50B6783F76BD05975764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022157, "uuid": "c65718fd-ff7a-4e76-a0ee-7715a7414ad8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022157, "uuid": "87b481ab-fb79-453e-9cbb-073742da6d86", "value": "24576:MLe1H1JdCheAtvAdvbwFOLfkzVtEHuv2YvV3GRWdtNbXwrq:MLe1VTKXAdvbwkG20H3wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022157, "uuid": "de796015-3c0b-4a91-b0bb-015ca3916721", "value": 1920640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022157, "uuid": "218b73a3-f56a-43ed-9e83-1bedad6b6864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022157, "uuid": "6668c5e5-8550-471c-b5a2-2cf8302b2aa4", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b134608-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066724, "uuid": "96f66a98-b6c0-49f3-8bdc-737a291c6a11", "comment": "Malware payload", "value": "4eb28a3e9b56f57c27e45bd8a4ab0138", "object_relation": "md5", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066724, "uuid": "12654409-965d-47d0-950a-bb37e1ce0c27", "comment": "Malware payload", "value": "daf386f93710ad2b2e46858b63174c8ad7c5ed436841c2a7ef2b4187ed8ba327", "object_relation": "sha256", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066724, "uuid": "32060f79-6bca-41b0-af80-a6ad74b73bff", "comment": "Malware payload", "value": "b8c20adff3ffadcc3322fcb1caf38336e2ec9a63", "object_relation": "sha1", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066724, "uuid": "98a14ba1-09ed-4fa8-ad3c-05b86ea5d849", "comment": "Malware payload", "value": "6f64949bd98fac3c2cd370e566577635991274e3df0885b6d61bc83b2ffe82df0d9af56a6e353c200716ed985cc9fa5e", "object_relation": "sha3-384", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066724, "uuid": "8ce5d9b2-6256-41e2-b1a2-23361f9f5c45", "value": "T1FD21CCBBFFE08862C551ACBC31DE605730111046CD9A041F3A0159AA3193BA58FEB2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066724, "uuid": "9692a25c-b9ca-4557-8612-f82013285ef1", "value": "24:LVsl2WlsPLlsdiHXyiTfkVFM2YHtR2YALb3N5rI55sTYsQ9:ESPLSdi3pTsV2GpLhdQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066724, "uuid": "c2644983-481f-4d08-9685-742b0fd2d276", "value": 1197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066724, "uuid": "ee96a165-2d77-4b46-b0ac-1f051e0ac2f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066724, "uuid": "18b12c00-6d51-492d-8cf9-644ed47313d4", "value": "daf386f93710ad2b2e46858b63174c8ad7c5ed436841c2a7ef2b4187ed8ba327.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8597d5-2ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775056128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056128, "uuid": "b4c9eeb6-7bf8-4f46-acf4-baf8b0748967", "comment": "Malware payload (Arsink)", "value": "42c662088a24ceed0a4c0f2fb7b745f4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056128, "uuid": "2c4a5c2f-72d5-4f24-a4bb-771869b2a3b5", "comment": "Malware payload (Arsink)", "value": "db5b22f8d3400bafa449b6db01f44896dd8040733b03d11dbc187146e58dfbcd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056128, "uuid": "c672a0df-2902-4dc6-baee-c0830f85c575", "comment": "Malware payload (Arsink)", "value": "e9db4bf6485763329cd2f9ed4ed19c36baaf31e6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775056128, "uuid": "89cb2bda-9474-4ec4-8e67-c1002aef0463", "comment": "Malware payload (Arsink)", "value": "84585e28160f88785279d248cabb86eb919566126dcabdcaf1c969d01be94a717ff99db639861d53ab94b8201e15061a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056128, "uuid": "d9ef0392-fdb4-4c37-bfc9-869ffc30e43c", "value": "T19B6423A94E2C8C65DB1BE03934565EA37BF4FDFAB8C40096292145E2CCA3B571F821DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056128, "uuid": "1a72ec55-23c3-4f31-8cc5-96c311c8fa45", "value": "6144:yCv+WjapW4sUSVST3vbgRDzWztpKVq7ulucX+G/43mhY0Rq:yFspVST3zgRAMxP+G/4WnRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775056128, "uuid": "d982cefc-53f2-4487-88fe-95e2cd300420", "value": 312066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775056128, "uuid": "f66fa7af-05dd-4962-8c63-f6f3e6512e3c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775056128, "uuid": "7d6ac254-9407-4647-b929-a05d2c753aee", "value": "\u041a\u043d\u043e\u043f\u043a\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a0cb34-2d82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775017504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017504, "uuid": "0b44569b-5fdd-4861-b9ac-b2b5fa4d3734", "comment": "Malware payload", "value": "5b8ee67f3e51dad275b54f870be0c6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017504, "uuid": "8352057e-2bf4-4f2b-8b9d-697d224a7497", "comment": "Malware payload", "value": "db63b0b4ab001c8c1d590af8a9b56bcaacf2c64c164c623ef458e4b281bfb1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017504, "uuid": "bc71ba23-f80c-4b29-b8d1-51e2a09a3b88", "comment": "Malware payload", "value": "8323a0579312b74cfa96d0b1fa86ba8504c96aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775017504, "uuid": "17eaae6e-c1ab-408f-b107-ee673ae4e248", "comment": "Malware payload", "value": "dda6c1f1251a8ef3716fafee6b681a4d434f8e1dc8b42853b3864deab2ebfdb85b3873ab6de0afa4df3b2838dc7015e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017504, "uuid": "49351084-8649-4e62-9d5e-ee281dca9fc3", "value": "T18B75BFA5F3C862D9D52BDA39D711A332D2B278124772B0CB0A9A17091EB7FD15F3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017504, "uuid": "7689844e-c235-42eb-886d-3d71a8e99636", "value": "77e4126fe49c03de7cc365c60f460a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017504, "uuid": "d286475a-af72-47e7-9f28-35fb7edd5155", "value": "24576:LcT73DAzuxUh+/4nIbbR1gGyU48VfXxlTuLTFb33RtlFOjQO0PxL5O8oj+KuC9gb:LcTjEEUh+FLlMnTwQTBc8vKZgxvprv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775017504, "uuid": "4b2eeb70-a555-4bfd-85bf-6feed72404b1", "value": 1662976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775017504, "uuid": "088c0850-6b5b-466c-8dee-e2f7946da98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775017504, "uuid": "fd458bdf-6709-4728-b943-a956435bc0d1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f9ae35-2dda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775055139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055139, "uuid": "538e5170-b771-4bc4-b506-237384bb35b7", "comment": "Malware payload", "value": "c2dad7c6bb6e8ca48492f032d050b959", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055139, "uuid": "a0d9aaf8-7c3e-4ed5-b18b-f3f24aed880a", "comment": "Malware payload", "value": "dc5b793f3e2d7f9581696018ee4b5ccbd6c926ec3646bb4fe6ddc6430a9de9e8", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055139, "uuid": "1b39330d-e132-44cd-9219-f9bb6308c4b7", "comment": "Malware payload", "value": "9929f339cbbe33896bead55742d6f30d5ccbba28", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775055139, "uuid": "fd8d7273-e7a9-4166-aecd-d59661d4efa4", "comment": "Malware payload", "value": "a3fa5697a118435bc092e81147158663fa7d041a6b0b0551144953e1ab016b66ae45e303b6d76aaa272c0f17937c3bac", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055139, "uuid": "897fa16f-eb10-4e53-b6ea-af79e153c139", "value": "T195B2E013CB72049602C6C2157DFFFA6897C6CEAE4689EDE1084B7C54AE07257E2115F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055139, "uuid": "339086e6-b2e6-499b-9f8b-1898050ae823", "value": "384:++qGy/3FZpeeQNYFXF0aG56V5RwBnd3eKNpkue3pgdU6cDp5McJNWJ4LIXH18h3y:/qxbpeeQN1v56L0dOAKue3pU9cDkcJzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775055139, "uuid": "83fb1741-b015-405a-a52b-ef3d5ba6c4e0", "value": 23403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775055139, "uuid": "2a59c9d4-c51a-4f09-a9d9-1dd7515a2cb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775055139, "uuid": "7f24c337-96d9-4b2e-afdf-1e794bc41a5a", "value": "t.ghj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a016b87-2dbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041704, "uuid": "74eb5072-3a2a-4b64-b48a-cf7f2f847b69", "comment": "Malware payload", "value": "06c086541cede3fa23aa111c9df2c308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041704, "uuid": "4d425f17-722d-4976-8cdb-170282c11f62", "comment": "Malware payload", "value": "dd404d1159202a1ac57af3f0e51b131331c8522c3e47312fe20a1647ea290413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041704, "uuid": "7fd3ef51-7612-4604-bf3f-0124db4b39fb", "comment": "Malware payload", "value": "38b7f0859110b029d33579eadae9394801c68240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041704, "uuid": "2fdb232d-9ab2-4de6-956d-ba2ae83ab0a6", "comment": "Malware payload", "value": "a266a99cfd324752658c69ee67cb846886030f16f6e6ef19086b1b99ec957f394f89530760108c5733b9912ac389dbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041704, "uuid": "7c13f342-3869-471d-b808-0d0b1b6b577c", "value": "T15B16BFB876047DD6A67F577BDA96ADDC03B626239ACBA8CC4064B7C30563371FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041704, "uuid": "2163abed-a6ab-488f-ac37-102109e03fc1", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041704, "uuid": "39e78050-2a6a-4219-9c4a-b35f47b15f9b", "value": "24576:7NapyIyJUgxc4QYBBuiGfZoD9+l3DOOUPi/hhi5DLBobaVXR6lvCovWZbzNZesxV:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041704, "uuid": "f4049400-30ad-49da-a65e-6320fa29d249", "value": 4114432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041704, "uuid": "d3212d9b-db94-4ec8-80f6-fbfcced8c86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041704, "uuid": "1cede880-584e-4c3b-922f-96cf7037a37c", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144cbaf8-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053291, "uuid": "71dc14ab-3824-4653-870f-390ea023241a", "comment": "Malware payload (Mirai)", "value": "ce86c04e156c12859ce46347058b16a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053291, "uuid": "11fff766-251f-456e-8016-420869aae16c", "comment": "Malware payload (Mirai)", "value": "dd7c7ad6059f02e87482e809d968b5017a8ee58eb6a7d81a884a35dabcae7561", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053291, "uuid": "8dd3c2ff-c278-4934-9982-d103a4ee0be7", "comment": "Malware payload (Mirai)", "value": "de8497d4b0d58403311d9236fc3562a9fe90d67b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053291, "uuid": "359b8101-5cc5-42b6-a3bf-5ceee0f7ad4e", "comment": "Malware payload (Mirai)", "value": "3ac4ba934268ff89d968d88a01d772808f4b8380b7ecb83c0d015bf83616a1d057dcb97751895c931a5a1ad57fe3eaf2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053291, "uuid": "9cfff8c5-5044-47e4-844c-10f0e1a0a459", "value": "T170039E53C93A2D94C63985B4F8219B7E2B53E949A5936FD6D826C274C003F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053291, "uuid": "755d4f1e-4cfe-4be7-a77c-61c5aa75289c", "value": "768:iTUc2eBs3+EuYG6TKjj53iGa/AEK9AKblZ3ay3VJ5egoS6VnYUvC5YMy3:4D3BsOEw5YLKQS2rCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053291, "uuid": "54f43f3e-1d43-4e2d-a664-86a7ddcb1399", "value": 39908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053291, "uuid": "ca8c0d14-e292-4e3f-aa55-a4c6fbaf2b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053291, "uuid": "3f601797-1c66-4c3e-960a-aa6b8160c5bb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616014c7-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040106, "uuid": "9324bb09-2e15-4a4f-b5d5-d9f214ba45c9", "comment": "Malware payload", "value": "9c678a554fc82b984a05e1e596464154", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040106, "uuid": "c1091e12-1dec-45cb-941a-2ebc3db4ad8b", "comment": "Malware payload", "value": "dd9f235cff12bd7ecfca75face1d525fe7f5d45edd066f5dddf4f66120763366", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040106, "uuid": "af95618f-bd86-49ac-b81d-42ac0a3c7e97", "comment": "Malware payload", "value": "2706a613c566cd3095a1386fb224b3797632efc5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040106, "uuid": "a1f19808-5c68-4d9e-912d-dec7031257ce", "comment": "Malware payload", "value": "9d3086fa007732c453d8a0e44701f393f28b3c0cfa552fe04ae96ebfc3ee69fa75f83486033eae0df80662c4846cffcf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040106, "uuid": "0d2005b1-9207-4b4d-9a82-db7af4ac4ae8", "value": "T1C2C633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040106, "uuid": "c7a4df32-e39d-49db-a8ee-dfd5e5407fca", "value": "49152:+6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOc6:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040106, "uuid": "668d2b65-a379-4d3f-b72b-7cb9b2172d1d", "value": 12190219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040106, "uuid": "ba055aeb-657a-4f96-b2c8-929dcd6f6696", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040106, "uuid": "fddecd3f-3e0b-453d-9cf0-43cf4a267c57", "value": "dd9f235cff12bd7ecfca75face1d525fe7f5d45edd066f5dddf4f66120763366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61d5e0a-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053616, "uuid": "c694a6ee-3042-4df7-bbd9-b6611fa2f0c6", "comment": "Malware payload (Mirai)", "value": "f56178d1d0927d540e2322d8674531ad", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053616, "uuid": "7ac6b416-00a1-40ca-a869-cb6825e81acb", "comment": "Malware payload (Mirai)", "value": "dde9fd731944a00b0403933560459362c2cf1ab1586062545f2050faf55f77c4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053616, "uuid": "21b86514-398c-4fa4-af3e-4364f5907ac3", "comment": "Malware payload (Mirai)", "value": "48d637eeb4bc53bea3e33eb7a26f7c949ec3f26f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053616, "uuid": "6b7efabb-f642-480f-b05a-b4dfa0026936", "comment": "Malware payload (Mirai)", "value": "2dfe8eb3ec0798646ec3376e58199f308473312ea0b0f92d4641c6d1133bca3b6247276b792959f9e5d52f0b22d16bf6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053616, "uuid": "b754327e-cd1f-41d2-a121-6b1d0766e632", "value": "T199B3AF87B2907ABEF0A45E3FC4135E26A6259F704583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053616, "uuid": "96605d4e-90cb-48d7-ae7a-a4e11bcc9fdb", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzk8rSR:t3SrlGWnKTU83AQB5A5Liy36fAUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053616, "uuid": "44accbe5-74eb-42d2-9f8c-9bd84bc5c319", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053616, "uuid": "6bf51969-dadd-481b-a20f-950f2650a4c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053616, "uuid": "9e54cc6b-038a-4229-8195-6d035cfa8b1e", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945cf5f5-2db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775039332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039332, "uuid": "7ff4dcf1-c73a-4002-9458-10355323e84e", "comment": "Malware payload", "value": "1c181d293749213c71da70d763fbf381", "object_relation": "md5", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039332, "uuid": "5f1bf9ef-ac5f-4cfe-ae3d-c8d4af5223f2", "comment": "Malware payload", "value": "debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200", "object_relation": "sha256", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039332, "uuid": "db6b2f42-2fae-46dc-bf6f-452eb17f26d3", "comment": "Malware payload", "value": "4ff8491aac50bd998a5ff0b003130b034c879715", "object_relation": "sha1", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039332, "uuid": "66d9a7bf-3758-44a5-aedb-e1e7f3023698", "comment": "Malware payload", "value": "524a9c7d64881231024aa90dcfae9cecec86a469c4da2824db715b8907ca8eb43389d5d17c36cd0a0708d3488a40741b", "object_relation": "sha3-384", "Tag": [ { "name": "pilautfile-com", "colour": "#727BE5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039332, "uuid": "e0dc6822-3ac3-448c-ba02-8d814083a299", "value": "T14C0110FE783234B25F5385EA9D5355970976D37F4FD02DAC28E9873414AD010A13222D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039332, "uuid": "66d7847e-4df0-418c-8ddf-03bfaed525ba", "value": "12:Sjly97dG3BCFrCR5V3FHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:OUxdGxCFm51EDlgNjTidGXhGIBFVR98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039332, "uuid": "70172f81-754e-4320-93ee-d7274e9c0a14", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039332, "uuid": "9c6377d6-b486-49d5-9d07-e3ac5058b689", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039332, "uuid": "29745534-a715-4aa9-8b8d-15a8ab1f2b8d", "value": "debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390efd13-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053782, "uuid": "a397ab31-e0c4-4658-b296-eba117d2a1cf", "comment": "Malware payload (Mirai)", "value": "d195375346e4fa7bc24f41360fe1c65c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053782, "uuid": "1261a042-91b7-4faf-b577-d2d061145dff", "comment": "Malware payload (Mirai)", "value": "debfe3cd6e14360251e5517ccf2b9e9275b82886bb6694c65d59f44784371959", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053782, "uuid": "c41d7ed9-f097-441c-baac-80d5355080e3", "comment": "Malware payload (Mirai)", "value": "54180e01af7436ed32dfcd446ed3c9b4fe4b5476", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053782, "uuid": "18ababfa-d72b-4077-ab55-57932f78b396", "comment": "Malware payload (Mirai)", "value": "c28f9c54a95384d75fcbd7c06ded529a4ee3f8d9acd9d4cf8cf1d3135f5fd1cbea39da2df15b807775f638122c11e379", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053782, "uuid": "ba68be69-344d-4774-a647-231776a003a3", "value": "T1DAA191E974B4937A3DA0ED7375D6CA42F24061A7E0C91C0EE6D6F0E8498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053782, "uuid": "3d63ff81-b1e7-45e9-a7d1-56dfb06e75b2", "value": "48:vpK8KMV4k0pKDK1V4QpKrOKrWV4hpKQKoV4bpKE0KEEV4EfpKUKkV4/pKDK1V4Q8:v3ednbiX2TGEpf7MFbjZfyj0tJr1jc/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053782, "uuid": "c9491978-305d-4721-94d6-7a48136eec5e", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053782, "uuid": "fc6fcfe2-a2fe-49ed-b095-03df2b79de1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053782, "uuid": "e62f3c18-80bf-4293-9aae-42963bd35437", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ba953c-2e08-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775074872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074872, "uuid": "736ac1ad-9237-417b-90ee-8e443e28aa7f", "comment": "Malware payload (LummaStealer)", "value": "b5ea66db81d1ee7f1117815441832d50", "object_relation": "md5", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074872, "uuid": "e1f53c59-2a87-469d-a53c-65b646cd1f79", "comment": "Malware payload (LummaStealer)", "value": "decba410c0c17f481c6ec5d3c4b8b75d568e1ac4fad0508e5d320dc9d1a5ec61", "object_relation": "sha256", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074872, "uuid": "0900f97e-eafc-4248-a770-d644c3fb4a1d", "comment": "Malware payload (LummaStealer)", "value": "f641c173df23bf0c64dd6b06e72adfaafd98011d", "object_relation": "sha1", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775074872, "uuid": "a5bb2c0e-3b60-44a4-9a14-82854a6f5bd5", "comment": "Malware payload (LummaStealer)", "value": "7ec8aaa6c9b0b6da0081504cc2d527c2f982725e14c58b5c307e3f979fa4cfd729e15d8dfdcc94180b913490da8eeac2", "object_relation": "sha3-384", "Tag": [ { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074872, "uuid": "d8173afc-81bd-4fcc-ac22-cc1684f50fab", "value": "T13406E0707FDA1122D1AAB37794B051306914BB4C9F6DC5BBB454EF884CFA880DF39A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074872, "uuid": "f023e951-0085-4f1c-8a28-91ce103cc0db", "value": "98304:U2Qq0NjLeH2zAEbEgcSWFsPFYFMeAgDodf/:U2QVZLsAm/sKqeAgDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775074872, "uuid": "f71eb731-5705-4cc1-996b-0bc42695f920", "value": 3768832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775074872, "uuid": "c7689ab8-9859-4b0a-8694-d85419753ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775074872, "uuid": "634a62ba-f67f-4d0e-8ed0-d11a08025113", "value": "Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd89b8f2-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775041576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041576, "uuid": "a1dc1fec-0071-45d4-8d8a-7f6fdbf099b2", "comment": "Malware payload (RustyStealer)", "value": "e87d066039e3fc4145f4c5d8bdde5fe3", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041576, "uuid": "ca41724f-9b3d-4520-9c8f-78539b52fc37", "comment": "Malware payload (RustyStealer)", "value": "e03ae62f41b0ec6fc3b7780bfa23d153e5601eabbfd5b57b0c13b59d62e94c1c", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041576, "uuid": "cf0c615c-b4c3-45d6-b08d-08e7629120af", "comment": "Malware payload (RustyStealer)", "value": "31b146d8da7cd2412d626e158fc8f65d2d0b0c13", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041576, "uuid": "2fee9aef-3fe5-401d-8968-432430958c00", "comment": "Malware payload (RustyStealer)", "value": "33eeea24eb73a62a4d9c859893e7292abe1a2441e10905fe10da4332b89b8daf28b64ad687fbf918947bf92fa43279e5", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041576, "uuid": "79924c2d-260b-4705-99d9-51172b47f16b", "value": "T150956D43E69581FCC05EC1B887579736FA32B88D053476EB2BD04B642E26F906F1DB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041576, "uuid": "6b41f15a-9b9e-425e-bb62-7d0603c01213", "value": "a0a005ec11df7327099e98fc94834a6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041576, "uuid": "8889fd53-8a89-4ef7-847c-5bbbe0751170", "value": "49152:PynheiSraGa7VHri7mitBPQnMiq8BRMLlPHE7MCr3KmZXIU6isx:PynZiFFQN7BiB86b+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041576, "uuid": "97ce1595-8303-43e9-852b-e87cffdc7e26", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041576, "uuid": "30dfd31e-cb57-46ef-95eb-ea74c31ab74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041576, "uuid": "12da98ec-8241-4d46-bdf0-4b462bafd1de", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4359aff9-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066684, "uuid": "e0e3aae4-62bc-437d-b54e-d7c08bf93630", "comment": "Malware payload", "value": "ac0c59a86b68849c879a92307d2483b9", "object_relation": "md5", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066684, "uuid": "0b73299e-1fc9-4c2c-b80a-266c2c226544", "comment": "Malware payload", "value": "e0d7c7df9562bef40c41835803a4af04a04f4f48f201e56c6f60dc58ae8c65e4", "object_relation": "sha256", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066684, "uuid": "22516903-5071-4f42-8667-e40b35326f5a", "comment": "Malware payload", "value": "91b16197b26d06fc64eef2b32fd451905cad0d95", "object_relation": "sha1", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066684, "uuid": "f2e26767-200c-4abb-b92b-2c20ad41596c", "comment": "Malware payload", "value": "86dcd012d3b57216d812b9155255b49ec152f68930ee876a05b67fc88da9f1a4838be09b4fb2585107aaa2774fb1826a", "object_relation": "sha3-384", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066684, "uuid": "238eb98f-9224-4a6f-adba-9315257e3ef1", "value": "T1F40110FE743234B26F43C5EA9D5390DA0976D36F1BD02DAC2CE68B3414AE050A12222E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066684, "uuid": "4013c8a9-087a-44f8-bd7a-255f2c68ea74", "value": "12:SPh897dG3BCFrCR5Va7hFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:1xdGxCFmkt1EDlgNjTidGXhGIBFVR98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066684, "uuid": "01a31e10-3922-4d6f-8873-ca61abcda162", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066684, "uuid": "03e0efc1-496e-4067-a4d1-b5b3c505a4f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066684, "uuid": "8806eab6-89df-4dd9-9da8-0d0b023078fb", "value": "e0d7c7df9562bef40c41835803a4af04a04f4f48f201e56c6f60dc58ae8c65e4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49fac17-2dd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775054902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054902, "uuid": "5a45851b-67f7-4831-9413-5ff4773faffa", "comment": "Malware payload", "value": "0d7196822b8b0693b8eb9cac81246992", "object_relation": "md5", "Tag": [ { "name": "CymRan", "colour": "#4116E3", "exportable": true, "hide_tag": false }, { "name": "CymTest", "colour": "#9AB680", "exportable": true, "hide_tag": false }, { "name": "Cymulate", "colour": "#D16BD5", "exportable": true, "hide_tag": false }, { "name": "Cymulion", "colour": "#F1A4E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054902, "uuid": "680453e7-5a55-49b6-87b9-17f4299aefab", "comment": "Malware payload", "value": "e130ed9dfb63d8df7b7eb249c4a7ad8726a91a9c3a235ff6eb289e5557b386df", "object_relation": "sha256", "Tag": [ { "name": "CymRan", "colour": "#4116E3", "exportable": true, "hide_tag": false }, { "name": "CymTest", "colour": "#9AB680", "exportable": true, "hide_tag": false }, { "name": "Cymulate", "colour": "#D16BD5", "exportable": true, "hide_tag": false }, { "name": "Cymulion", "colour": "#F1A4E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054902, "uuid": "535571b2-1c70-40d5-9171-d675d4b08d56", "comment": "Malware payload", "value": "049a1449b0f792d5041e273edc19599ea249d0bf", "object_relation": "sha1", "Tag": [ { "name": "CymRan", "colour": "#4116E3", "exportable": true, "hide_tag": false }, { "name": "CymTest", "colour": "#9AB680", "exportable": true, "hide_tag": false }, { "name": "Cymulate", "colour": "#D16BD5", "exportable": true, "hide_tag": false }, { "name": "Cymulion", "colour": "#F1A4E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054902, "uuid": "7a6c3438-a950-4d89-b890-64e6b49c2c31", "comment": "Malware payload", "value": "3f70614c906ee095c66cde70f61c6dd8b99102ca910e6bc6238644fee3de9184cb4b9059779a4f1f056a44d7cbb98bdc", "object_relation": "sha3-384", "Tag": [ { "name": "CymRan", "colour": "#4116E3", "exportable": true, "hide_tag": false }, { "name": "CymTest", "colour": "#9AB680", "exportable": true, "hide_tag": false }, { "name": "Cymulate", "colour": "#D16BD5", "exportable": true, "hide_tag": false }, { "name": "Cymulion", "colour": "#F1A4E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054902, "uuid": "574fe5f2-c444-497d-9ac9-896673f4edf9", "value": "T1DC457B02FBD044B5E4BB813989B35616EBB5B8650730DBCF23848A6A9F377D0AD39711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054902, "uuid": "448b2186-0be9-4481-96e2-3901600fa4dc", "value": "677f09f17b9d49a277e80fbca9bb1c70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054902, "uuid": "8bb6ff1c-c500-4689-b087-ad32e24e785b", "value": "24576:E329y1J8qCxeAqQATm9UrZbyxSktoL3b8mEB0+nf:EG9y1yTeFlmokGL3bqm+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054902, "uuid": "f19856dc-ec1d-4481-a128-cdd752864f50", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054902, "uuid": "22123954-8de7-498c-b7e9-7d7b692f0fd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054902, "uuid": "1baa6eeb-3a0a-4f8c-82e0-5d5b4e72374b", "value": "z2qlum5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91af7b1-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775041514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041514, "uuid": "ab512ee5-757f-4f64-aee9-5df7319e78c5", "comment": "Malware payload (Vidar)", "value": "45cde213386b43f7a37c2690d6067daf", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041514, "uuid": "76c1cad6-9ead-45a9-864f-e51300829cc1", "comment": "Malware payload (Vidar)", "value": "e268324d79d6ef3f04370fbb06ce26a8b3db7a34b92731a0c5582a0fe800547a", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041514, "uuid": "ab1da471-b4a6-4a13-b4fd-8908ccb45512", "comment": "Malware payload (Vidar)", "value": "a5dce5ba533140bee012c63cd8cc315481c79e25", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041514, "uuid": "9b36443b-f844-42b3-abc1-0e73e0d4a069", "comment": "Malware payload (Vidar)", "value": "5e8359d7931b0a877b64e60f3882cbdb97180730a87cdbaf34c0d33ecc9a02204a7ac3c831a6d0a96fa7e0afc74f7acb", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041514, "uuid": "e311d598-f520-499f-92c2-b6d6b83c5ddd", "value": "T17C46AF92B3C04DE5C1159674862F9332C2B2BC614B79C5CF1A66F70A9F3B7918E3AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041514, "uuid": "46d9d6a3-48a5-4850-98ec-7571b940800f", "value": "f245dfc0f9742e967a052e9cf0e0e79f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041514, "uuid": "ebb4d116-8bc5-4172-b7cb-a549c91034fb", "value": "98304:sERq1vbU/NiFNDKxtUM7WpPQTU7DRoqCAq2tHSg6R+FapwtKJ3lO/P0U92Zx858G:sEs1vgNiFetFy5e1AxoREavJ1O/P0e5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041514, "uuid": "1bcef533-7a05-4cbe-9a98-afbb040690cf", "value": 5874176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041514, "uuid": "ab5e7a79-31fe-405e-9b39-e05467784041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041514, "uuid": "7d93b627-25bf-474e-99f8-24edf8bacc36", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdd468e-2d9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775028099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028099, "uuid": "3efd54c5-cf52-4b55-a197-e0071a2953dc", "comment": "Malware payload (Joker)", "value": "e22219423ebcddcaa390323853e381f9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028099, "uuid": "1364f2fa-9dcc-4cda-8a29-1eb935a6f8c7", "comment": "Malware payload (Joker)", "value": "e3c455ffe8183008c33ce997356343f615f86fb0cfd3948032b4d48ca3c3f813", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028099, "uuid": "0f946849-294a-4c7b-9269-90e9b0bb0e42", "comment": "Malware payload (Joker)", "value": "1561081d86023a5b5b3536c672490b95d3611f15", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028099, "uuid": "6ed75459-2eef-418e-a413-a67e05cf2ac2", "comment": "Malware payload (Joker)", "value": "3f5b737a4613322ecd8a5319c1b34d296ea2e907e24d27ed939507e12560a40dbf1a21c11b0e20607b10e2c0ddb3bf99", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028099, "uuid": "276af0d3-7bfc-470a-83d2-fd591905e6e8", "value": "T15F37E089FA1CE42BD9FAB0BCCD8F0793B56279151610C19B3822820DFDA37D49B55BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028099, "uuid": "67a6ad57-d7de-4d9d-88f1-7b6a05ec579a", "value": "393216:ynK4ZXo8Z63kR8Qt4lJN+Zk0JKMAGDA1LrQxCuKrW701QCFBga:SDhZ4hlSqGDA1LcFv4Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028099, "uuid": "381afd19-975b-4386-b6b6-4e176d1cc2ca", "value": 24064326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028099, "uuid": "c5bda86d-0202-42e6-a8b9-bef0d9c5ed94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028099, "uuid": "de18dbfc-3d52-4243-837c-0cab588c6f1f", "value": "com.textloving.sumer.messages_3.6.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d3742b-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060781, "uuid": "b778c2af-2ae5-4846-9e95-ae8c02dcb69c", "comment": "Malware payload (XenoRAT)", "value": "aa95a45b0b7d2cc6a68068b473ab191c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060781, "uuid": "b5052602-bb2f-4931-8665-4605de1574ca", "comment": "Malware payload (XenoRAT)", "value": "e438002739eea9295f9f80b3d76fad809d95042ab695f20574e548a996ed9b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060781, "uuid": "590a824f-fd18-48ea-bf9a-06fe4aa11767", "comment": "Malware payload (XenoRAT)", "value": "a3e189e9100d8e72913f16677721087c31c487db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060781, "uuid": "5869786e-c6ae-4b0b-bf7a-315e67157ac8", "comment": "Malware payload (XenoRAT)", "value": "fd7f70128f158b953fe9a34c3f6a5a43ce8ae482cbd67325d2347474939f3547980c28ee789fdcb0e4a9da702acca0cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060781, "uuid": "f7f8194b-5f66-4ed8-9d48-9d5423ceba23", "value": "T159B30B6BF6C49707C949C5388D27807A66E3651E12E3F226006B6CED3DF23F9674721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060781, "uuid": "d579b7d5-999c-413f-9fa5-3d8ed90b4056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060781, "uuid": "0ded962a-c332-4af5-acc5-67a2476120c5", "value": "768:bdhO/poiiUcjlJInV9SH9Xqk5nWEZ5SbTDabuI7CPW5iZ/YJ:Jw+jjgnVoH9XqcnW85SbTOuIuYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060781, "uuid": "795fbb50-d8b5-4574-a38c-54a5e1cb5b8a", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060781, "uuid": "7b5a7463-25ba-48bd-a4f4-b7c76f73b394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060781, "uuid": "f64d23b7-91e5-46e3-b947-5fc8dd05f7ca", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5a9bfc-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775028586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028586, "uuid": "28b1c95a-b76e-411c-ab52-b27ba9792667", "comment": "Malware payload (a310Logger)", "value": "c47affb84b8856425f3e6252eb5ed161", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028586, "uuid": "e01ffe4e-cee2-4442-bce0-437cb94402c6", "comment": "Malware payload (a310Logger)", "value": "e452b95b8707139fccb98f931901ef3a77b8a199e7fa8e421e4e0a66f8cf0cc4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028586, "uuid": "2828f4e1-4fbe-4b47-8665-1f480f160176", "comment": "Malware payload (a310Logger)", "value": "dabaff79f52b2b6142fdabd00cf89cb9cdd7a7c2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028586, "uuid": "1b76c476-20eb-4da3-9e03-2e8d098d70b3", "comment": "Malware payload (a310Logger)", "value": "a2452e954e5d4641c185af348f2cc78e904ccd7b089c08acc0443fbc2b7e7a9b5076e431a108ab3108b59dc5d9c5cd63", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028586, "uuid": "deb2121e-1df3-4b5c-8aa9-f51c386e7a2f", "value": "T1830523A095C06855C025A772883AD850DA7878F16E02F76E4B79F0BFBC71393E536B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028586, "uuid": "25b13b62-c903-4f55-9050-10a8bf6785fa", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028586, "uuid": "ebaabcf5-6190-47bd-b16c-f57f1dab2a40", "value": "24576:pf+iN57Gtene3os5uxJZigR8i1KQmFcPY:lLXKtene3oHrigBKQmFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028586, "uuid": "c6e274e8-19b1-4eba-9977-d03b8caea4fc", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028586, "uuid": "778aa105-e06c-4561-bd1b-d6218a77b9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028586, "uuid": "de65057d-b591-47c9-8477-53057cc093f8", "value": "AWB No 812134885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a023ad5-2d91-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkWatchman)", "timestamp": 1775023692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023692, "uuid": "9fe09bce-a89b-4ad2-be66-d54f9f9399eb", "comment": "Malware payload (DarkWatchman)", "value": "b346af9c285e8541d567a4fb49672434", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023692, "uuid": "ed07f7f3-a262-45fd-8329-9571feba2a94", "comment": "Malware payload (DarkWatchman)", "value": "e54d1745cf9b6690642c4eccb7720c21468c4cd8bc73d5c4f542b6db69970ef0", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023692, "uuid": "b227dfd9-f98f-414a-ace0-7df37d1d38c9", "comment": "Malware payload (DarkWatchman)", "value": "7d529d001c5a333bcd5cb4674a6881f46cf8592c", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775023692, "uuid": "c459018a-1a8c-4252-b098-4bc493a68dd6", "comment": "Malware payload (DarkWatchman)", "value": "863d69c2caec44107e49f1c1d622364606a8f084ddf156b1c7a809f85bd68fc09372a38382d52a6a56a9d2e96fc562fd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023692, "uuid": "64edcbcc-96c0-47af-896d-6472da694119", "value": "T14E74D002B6D28872D57329325A3AFB256D3D7D201F24DA1FB3D40D6EEA314916634BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023692, "uuid": "1622cb90-a7cf-48fe-b29e-98a3c85b9985", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023692, "uuid": "2b67a620-726f-4c25-adff-21522cfefa0e", "value": "6144:5OYGXaPNxdgSdcq2pVZPOJHAbKVLk8oGA47HmImqVYTQ4Bg4K:lGqN/XdctpVtklLkeHiqVp4B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775023692, "uuid": "195d05e8-fb14-4bc7-acb3-24ac20388149", "value": 361049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775023692, "uuid": "15ac80ee-eb50-48dc-a763-fe48979b9b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775023692, "uuid": "4f210b1c-5a2e-4aa9-b203-72568a947d53", "value": "b346af9c285e8541d567a4fb49672434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104fe4cb-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775057579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057579, "uuid": "7448eba1-3781-4c99-a352-95c0d5fdd66f", "comment": "Malware payload", "value": "8cd86a16fc2033e4b5490470adbd53ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057579, "uuid": "f52d1472-cbf2-4535-a9ae-4eec52ad9b71", "comment": "Malware payload", "value": "e5de1daebc620b7a9c8e17abdd8e56270a061095a36ba6ac3a0cde1a072c8819", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057579, "uuid": "dfc554f3-3356-4776-9132-28484f143d1d", "comment": "Malware payload", "value": "57c262f8afb2d6891f832a765d735ea9f87bfda4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057579, "uuid": "6a3d8ee2-823a-4676-9956-005aa99bff41", "comment": "Malware payload", "value": "75ff2692ae2e8837872e307c7a2f4ca272a862e85b3242b7c0a66f0232d1c5fdd35f0f18a9049db1e3ed582ac2bae172", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057579, "uuid": "bb36fa88-b707-4230-8be8-584574b9c8c6", "value": "T151D2E7C4EE0379FD0F06270DACFF4961EEA826457571A274F95F8F046380278A2761EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057579, "uuid": "c3175fc9-0097-4d06-9704-305e016d714f", "value": "384:dFEwHHdzZZLdhCw+NIpSpFQiqbSs65N9JDa19SzwINcJDQ87DlsJAFFPSFnOd:/Nf7+NIpSVtxPL3qs+sGX6wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057579, "uuid": "a72fc84d-f29b-4b6a-9251-d04c67bca2c5", "value": 28738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057579, "uuid": "c570da5a-1d0c-4387-aa2e-d3f41d996624", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057579, "uuid": "84069dbf-703a-4040-b043-9dea17f3408f", "value": "kotacija 31.3.2026..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6537649a-2db3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775038394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038394, "uuid": "56ec8c20-30c8-4172-9cb1-baf09e39b0bf", "comment": "Malware payload", "value": "b9a9c9d438bc6ca2fc272de4f878b8da", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038394, "uuid": "4203224e-6bb5-4bb5-8a4b-0b8be9daa769", "comment": "Malware payload", "value": "e6235b7e678edf5c227b84d9a2c955cdeefb17bfc35a4567fea1efbb059772f7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038394, "uuid": "d5be8bd1-7e98-439e-8224-473c05df3dbe", "comment": "Malware payload", "value": "af22c780a6bcc1e89fbc9a41a2489fdba1f341f7", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775038394, "uuid": "ac0733fb-aad4-4654-9291-ab6a68b2fee9", "comment": "Malware payload", "value": "67046bcd48f0c5f976ffb6a6832e1a74768d004ed5671213ba48fc5fcc20d84b4539fc9c06b04f94764932df1727320c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038394, "uuid": "676c204b-be51-4887-a911-81606d1d5064", "value": "T12D57235BA5E291D4CB830B405ACB11DD53D1B19EC9ED522D2ACF5803B431FAB8B89E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038394, "uuid": "3d48737f-d717-46a9-b81f-68f787b6ad1f", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038394, "uuid": "2c351b66-7734-496a-8306-26083a533b08", "value": "393216:2CAbzc1qF57v/cLmkg9xytpnL5yPaf+H45Lb0d5LPaFciZquET+8e8LPUS:xMz/2XLLfF5Lb0dcST/5LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775038394, "uuid": "3ded308d-bd17-4c6b-b16f-500f2cae2f80", "value": 27568128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775038394, "uuid": "df1619b7-19d4-4378-b75c-1123d118694b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775038394, "uuid": "2c2aa763-dc5a-4d66-8d41-9caf1e92a7d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6564b1-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040094, "uuid": "8eecd9da-fa15-41f2-8f1c-cbef7d9a9dda", "comment": "Malware payload", "value": "87cb28b50e3143bf9799adbc7443c595", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040094, "uuid": "095cb4b8-3071-4cd6-84a2-49fb80f9c1c9", "comment": "Malware payload", "value": "e64c78c84a4ff05bd73230fbfb4ce2f0ac88cc2aca1abfee1c19ad5bd9168e3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040094, "uuid": "42f1df31-4dbb-4bbb-abb8-0c8f6096e539", "comment": "Malware payload", "value": "78ad9be15d1a86c82224dcd6419e2f02306a71f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040094, "uuid": "4483a728-7a9f-4e98-8547-dd6f268f5ad5", "comment": "Malware payload", "value": "a666252256ffc454e38609fd3c4b69d9451f13be23ff46188a7d220c79ffe35b918b7d235d3074ed0630afb2128e44cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040094, "uuid": "9c2b0e28-c6f3-4469-a63e-8d4e746804df", "value": "T12AC633306E993EBD436C8364607F6F2D1FB10FA39458E5CB6AC525C64CA9B428267C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040094, "uuid": "d3aed6a3-e646-4300-bdfe-8122602f122b", "value": "49152:M6q/kybcffR6aQ4YtFoGta1GVJLgtwDSgbvsZWZbQ6dQRB4+NThHpHkMhVIXrOc8:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040094, "uuid": "d89b7c55-d1f4-424f-96bd-8a2224af14ec", "value": 12190207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040094, "uuid": "42759e38-18b2-41bc-b689-cac312a9d053", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040094, "uuid": "fd521d56-4dbd-44e2-8a90-867cab5e6412", "value": "e64c78c84a4ff05bd73230fbfb4ce2f0ac88cc2aca1abfee1c19ad5bd9168e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7069dd-2db7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775040122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040122, "uuid": "64d5c7c7-1026-4a37-8cb6-fa9acef84237", "comment": "Malware payload", "value": "e58cc2275a91e394610440af0c9fc99e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040122, "uuid": "71c3e2ff-8be0-41a8-895b-cc7d92e0fb45", "comment": "Malware payload", "value": "e64d33a27a6ccfe5138f2865b41dfcabc362bcc5cab96f13f95a005db3bb1039", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040122, "uuid": "ea384437-bc0b-40ea-a599-191d3e78ed16", "comment": "Malware payload", "value": "410549cfed44b6dd5cd239ce5beaf46d93725153", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775040122, "uuid": "d9167f19-1e76-43e2-89f2-124c709fb180", "comment": "Malware payload", "value": "ffbd87067daaa0c74e9d6a520ceace625007bf00465e1ea38f535f1269adc2836276ea75b901af17db353309dc157c89", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "update-check-com", "colour": "#9A4DB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040122, "uuid": "43d64ded-19ea-4fe4-8600-1545c5db4fb4", "value": "T139C62338AD8D27DE0A10E2F6B11AF4497EDD23874C86571703AD82A438F44B59BB7C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040122, "uuid": "d4ca49d7-047f-4d21-a2c3-457e552b6938", "value": "49152:y+eTdAa4h/xnkD5opwYuvxVi32B+3ljtJbPXNc61Ak4pQ4Ur/DiutVvHJBmC1S99:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775040122, "uuid": "ee05a089-ba44-4c42-8874-ee2d380e3448", "value": 12348654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775040122, "uuid": "b9a2e8fd-3a9e-4e43-abed-3621b43e2118", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775040122, "uuid": "f44a67a6-5f8e-436e-ae66-cd38459068f1", "value": "e64d33a27a6ccfe5138f2865b41dfcabc362bcc5cab96f13f95a005db3bb1039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bab939-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775050584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050584, "uuid": "35b0c1e0-8549-470f-930a-811e29df4c33", "comment": "Malware payload (ConnectWise)", "value": "ca904188bb9ffbab703aea85c40746f5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050584, "uuid": "bc72fa13-42cf-458d-8cd0-3e7b38bbeeb9", "comment": "Malware payload (ConnectWise)", "value": "e67ccc2c4df908ac20729b05e246eb2a2992e8c5558c43b9bc9938371cb4fb43", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050584, "uuid": "c93dbe5a-f2a8-4627-8b55-0a3059cc4b39", "comment": "Malware payload (ConnectWise)", "value": "c1934348e054574701f85bda11479c08cabd84f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050584, "uuid": "935a3f8b-e604-4501-a68e-8b0520b40169", "comment": "Malware payload (ConnectWise)", "value": "bf90ed7f6aa27166dc915a0f4d1aa64f5ae9da17ba770c1d8a25b098293e182a34f5e01581f7731c37789f9bbfd1409d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050584, "uuid": "2fbbd7a7-a3e0-4721-8583-2a851ef3b42c", "value": "T10FD61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050584, "uuid": "248cc394-e405-47a0-805e-c6cfce66994d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050584, "uuid": "8ce9c34f-529c-43ab-ba3f-cbe01928f028", "value": "393216:pCXvI5MvHx6J+CXvI5MvHx6CXvI5MvHxPCXvI5MvHx8:pZ6HxVZ6Hx6Z6HxPZ6Hx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050584, "uuid": "5f865280-d2b9-445c-befc-6338df14e88b", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050584, "uuid": "06c54f15-8581-4276-a869-2c7b72d03593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050584, "uuid": "aca4a2fb-293b-408a-8e8d-8f0dbdeea4f6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264f03d8-2e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775079950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079950, "uuid": "d14e6626-bcef-4b1b-a4e6-4ba6512d6c2f", "comment": "Malware payload", "value": "a77131589140659ce0d41f3f7c74375d", "object_relation": "md5", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079950, "uuid": "eac9cb01-3ae9-4be6-a986-4eda9d4c2b47", "comment": "Malware payload", "value": "e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b", "object_relation": "sha256", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079950, "uuid": "8df6fa0d-e9e4-4d61-882d-4d71ff204e10", "comment": "Malware payload", "value": "00abc9504092e3633043e1af4694b3b2ad182c77", "object_relation": "sha1", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775079950, "uuid": "5d3d9cdd-175b-42d0-ad42-dcee8cc00a2e", "comment": "Malware payload", "value": "5f5eda6aacb6bea47a2f13b53ed58e61fa291094645ba631c2a4e6156769dd66968b29ec6fda291929e557d2b8a6a068", "object_relation": "sha3-384", "Tag": [ { "name": "158-94-211-65", "colour": "#8E480A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079950, "uuid": "c987a239-8546-4744-a81f-9496bfd2a609", "value": "T15CF46C2EAF53BF9B9C8222F1D7975ACCEAA4025A439356987D7CE6443C4CC6803DC59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079950, "uuid": "e9a56d54-2655-43f8-90cf-51c181302b1c", "value": "6144:ZeNdvU55puGsnoc8Tii1luGeJ3bYncqGaHgPJC4eVdHMEnZP/0Xr+myqpESAMtaI:INdc55pfy8vkGzzGan4eIYJ/0ty/+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775079950, "uuid": "23a5d571-bb2d-4570-9135-e406b673b4c8", "value": 794028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775079950, "uuid": "68f26570-0b3e-4604-8e02-a17e5d431689", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775079950, "uuid": "253ecd3e-45f3-408c-8289-ceea192130d7", "value": "puk3ta8cyv1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0687395-2dcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775050573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050573, "uuid": "5ee67260-835c-4ced-a8cc-6bfb3f71eb95", "comment": "Malware payload", "value": "c036c7812cca47d59e2a210863e0a7ce", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050573, "uuid": "df2b482e-b1f6-4b44-b9a8-cf49d26906af", "comment": "Malware payload", "value": "e7074abe8bf9c49ba0e0b1cd6b4d119378ec70ba380d44f33420c9d0de650bf2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050573, "uuid": "20eeb95b-2e68-4062-9a6b-42f078cc64fc", "comment": "Malware payload", "value": "ed5de30f03f22ed8fc4364131d55479ed2d86c0a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775050573, "uuid": "3c651d72-aeae-4814-94e8-831b2b05e87d", "comment": "Malware payload", "value": "73d20055ccf3876a288fb9622386f5444f10ed43c7e5d727019f661aac690eba961ea35cd015a6b89650599035443752", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050573, "uuid": "d54b21bf-a30b-4c2c-b174-aae84e39f232", "value": "T11B51A44BD5179C6359E311B3C682290CEFE7972234378429BC1CDD1A3B656FCAC7828A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050573, "uuid": "bab68081-6633-4630-8d09-2ff6b9ff354d", "value": "48:pqPhN5hond9sx5+Eb3wDSqM4J8R0DDCWwVGI043q29AxGAI:pqPfJ7+iwDvM4c0DrGGI043q29AxG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775050573, "uuid": "a401e959-0bc0-446e-8aac-db44406fecd4", "value": 2679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775050573, "uuid": "7b8168fc-831c-46c0-b04e-97df3868ff39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775050573, "uuid": "7de80950-af59-4917-a615-2e9e5a60f92f", "value": "Social-Security-Statement_04012026_d706db03.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a351918f-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1775028620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028620, "uuid": "f8329a18-182a-4524-b17d-9538713cbe24", "comment": "Malware payload (DarkTortilla)", "value": "93b99147aaadc108b0c783a8addace34", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028620, "uuid": "47156193-fc6f-4484-a968-b05f6c6f0d48", "comment": "Malware payload (DarkTortilla)", "value": "e7720fc588508abd539245b6cabe3f334dd3b6446fc024ad507484618538b0fe", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028620, "uuid": "04e810a7-b952-4385-99e3-213bf8a053a7", "comment": "Malware payload (DarkTortilla)", "value": "383a8be6e5b88ad72ffa77f12d597e17e852d768", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028620, "uuid": "b44a27ca-2f0a-48c8-a9a5-390e0a32d15d", "comment": "Malware payload (DarkTortilla)", "value": "540e4d5a39c7ed3349539dcc9abff3458f64b9f8a14990758e1235d2be7b15ee880ef3e82aa6087c5ecfd4a84565c6f9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028620, "uuid": "364dcc5b-c760-496c-ad03-6dfe722e61ea", "value": "T148F4CF106E476F48E62D0F78C022086863F6DD1B9697E60FAEFC39B57AB7B45C90B441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028620, "uuid": "86dad795-340b-4dd8-9c75-0ce8bc45dac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028620, "uuid": "6b95dfee-a394-49d1-a706-7d154fccfb9b", "value": "12288:w8RjYA4IWzvrdprmTEoF4e8cmXFUDgO2TKfHJEfM/E6P2VgBeH9aBEAmD:wMjKJprEF4Am1UB2TKf+6uVgBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028620, "uuid": "85567559-da9e-4939-8392-cb9027bb9ef7", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028620, "uuid": "cb032928-0f81-4f7d-a4e5-87875566eded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028620, "uuid": "091565db-bdd0-48a8-8cbb-28439719c86e", "value": "Tax-Filling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda8f434-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053629, "uuid": "054599b2-fdfd-405a-8e81-0aa022162cb8", "comment": "Malware payload (Mirai)", "value": "7607422f369a9d4752abe91f0455f12a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053629, "uuid": "bd22c543-9448-4f49-8456-b941625da408", "comment": "Malware payload (Mirai)", "value": "e85eb5bccd2cfb000db6a0a4dd0d29921e1e512fa3787a1eb15e764a0b050037", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053629, "uuid": "31460683-0724-4d49-8e5d-a83b8f039aee", "comment": "Malware payload (Mirai)", "value": "8af1f1b4c61a07248c9a1672dd401c4abdcd161e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053629, "uuid": "84a39afd-0bdc-4f78-8175-06560e2b5619", "comment": "Malware payload (Mirai)", "value": "6f8a010fe79bdcff90c69f0a592dccca7b430fdccfb9ebfe6e5c100fd49cdfa8fe5934ec6d00485799b88183502c29d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053629, "uuid": "4296df39-22c8-47c3-9c81-765daf35b20f", "value": "T11351A29B0280DB72D65CC54FB7F8B534B14AA18366DF9E08ED801A2C8ED9D4C76C5F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053629, "uuid": "1a3f0e8d-04bd-4320-b223-478ba63aede0", "value": "48:q+N8O82JMIVyVbiB8xnxuZUAUAcvyyk1YnYbwLPtxtm9YBnOnhM3Ia0:A52JMMqbiBsxuZQYbwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053629, "uuid": "405e24f1-bd88-49b9-bd83-64e6aad848fb", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053629, "uuid": "c0fd19a1-8ca7-4d38-8aab-cef794a35599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053629, "uuid": "89692027-3054-4430-9560-b1720121a303", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89230fd8-2de7-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775060788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060788, "uuid": "57582b04-9bce-413c-8a00-8d23b48e1eee", "comment": "Malware payload (XenoRAT)", "value": "a3a7cb9859d0597b275a6dc3d82c9a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060788, "uuid": "55ff70b4-4c83-406f-8b6f-0ce288e267a6", "comment": "Malware payload (XenoRAT)", "value": "e86f415748d553963c94c5b1c4bef7740e711bb0d4bda2ac5c86b07797b0a821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060788, "uuid": "1332ac01-fed1-4066-917a-86b69e42ddf6", "comment": "Malware payload (XenoRAT)", "value": "f0106b474992f029e2b8b6521842db9eb74748c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775060788, "uuid": "856a14ab-99a3-474c-aac6-584f07025efc", "comment": "Malware payload (XenoRAT)", "value": "9cb404302297aadb5dde7266f39e9ffa015e55eeb27905f8164be52f39edf7eee78fa75244c688e2ad6d6f46fe19ccff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060788, "uuid": "5bf67b2e-90c7-42d8-b66e-562dd4cd0327", "value": "T1BD548EC92FE50C9BD25A077E1E607B3CD263997AF1A3D3072A9D4559AF4FB810E42B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060788, "uuid": "f5ec8a61-4891-47c7-ba9a-e2dc8f186d30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060788, "uuid": "711ef94f-1dee-4303-b5b3-1200e3f84657", "value": "6144:CWjR+91UbkQo+xI3QG1mq6yTLygwM2LKT4mvrTZXbKb45wjlTy:C0RchQo+xIeqfKK8etjwjlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775060788, "uuid": "73c8b027-82b4-4db8-a4bf-7693139b5ae0", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775060788, "uuid": "0f2cd403-65f3-41fb-befe-991ffa530502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775060788, "uuid": "3daa3aa5-600a-462e-9578-61c8a8eb7cdd", "value": "VainRiader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e071441-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041496, "uuid": "b45f92a7-e379-491d-8b4a-4a745db950ca", "comment": "Malware payload", "value": "7646a872455dab186dc9de17f7ef0340", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041496, "uuid": "b019b974-dc12-43ae-8133-4ea93d1ca268", "comment": "Malware payload", "value": "e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041496, "uuid": "f7ffa7eb-38be-46ef-a72e-3d5ea2e2210e", "comment": "Malware payload", "value": "27cf71eada45ceb298cd793219c217452241e443", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041496, "uuid": "0c809308-28c6-4e17-a3bd-14f48c883118", "comment": "Malware payload", "value": "9b68bcafca92a6d7bc1ca403c816cf6b6369876c7d9a731f07fa599e4d888f5c7a865b9002960545d38908e76d7d8078", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041496, "uuid": "0ee829dc-5c02-4cd0-9a4a-45a1a47d501e", "value": "T1933111DA23B7A3308EB345876F97681A085F97867606FEA07AEC44840FDE40403339F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041496, "uuid": "d7e15449-5368-4d2e-a3df-eff3a1993843", "value": "24:21mCVKEKRNZiOzxcTsWLeyACqALe0BfCdDI4eCdS9hU3+4:MKEAH5bBlJ8LU3+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041496, "uuid": "bf622515-a4ee-445b-b1d5-c4c85869fd29", "value": 1632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041496, "uuid": "d81fe064-9011-4d77-9fa6-eb10c3bcd9ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041496, "uuid": "b201cca2-638f-4f51-9197-c0de56d90710", "value": "e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81b8f41-2db6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775039929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039929, "uuid": "ce499cc6-4b5e-448b-8c46-6cc44ee84f2f", "comment": "Malware payload (Mirai)", "value": "491586723dd5cdca284b1612b533d73f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039929, "uuid": "6670d6a3-2245-4296-9279-7d5fbeb0239e", "comment": "Malware payload (Mirai)", "value": "ea61e090f64b28c641b4d7c1fd771082eaf91bec933242589e48f525cebb3da6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039929, "uuid": "d51d78e9-276d-4fd4-95c8-2c47c9a6c8ef", "comment": "Malware payload (Mirai)", "value": "070a73addee28f81f2e26ee9c22c9c4014f51b6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775039929, "uuid": "03189528-a9f5-4b86-b76c-f0c63a15b675", "comment": "Malware payload (Mirai)", "value": "15b045e425abce3e0335477f9744cb3a2a4e45f8468e4558c26c239f7ce53b67cdca4c5c6ae32e07ad21e6bcd51ff27e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039929, "uuid": "9d4a2425-ce78-47c8-83e7-dd6453215120", "value": "T16143F22EC49D5C99F698C03C2DEC734E58B0D10AEACA5AE44744464EC983AFAFF64DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039929, "uuid": "125d8f42-f12e-4574-b34c-3d600f8ce644", "value": "1536:SGIsYa2RmMEH6D1IqZdHXXCbgOg5R/GQREWnouy8KyW:SGIK95q2qZRXog5R/GcEmoutm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775039929, "uuid": "cd084365-0617-45d7-a766-32e771bcbcaf", "value": 57248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775039929, "uuid": "ddf9080f-cc19-4b21-81b9-7f1b378041fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775039929, "uuid": "ba880984-b997-4ca4-a350-7e5fdc8bbbcd", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc06b37-2e1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775082779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082779, "uuid": "cfe2e807-27d2-449b-a4cc-073af76d9b24", "comment": "Malware payload", "value": "a5beb02fba945f117570d7c00ed05d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082779, "uuid": "dc45ded6-940f-4d59-a46e-d69800bfab39", "comment": "Malware payload", "value": "eb2db389d64987855fa5db905bbcb7b100f9d6c1699eaf5d846a98680feae1df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082779, "uuid": "679e0f12-61e3-4982-a42c-b9f7a54ed4fe", "comment": "Malware payload", "value": "cddcc7b67306e73f320c89200b75cc3af980211a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082779, "uuid": "39bf5b56-e8a5-404e-8372-51f2672d849c", "comment": "Malware payload", "value": "318c78d47bf0ce1cd15f4c3e57bcd4613985db3045e1bc90be6f4183fa4f760b7c2ec663f89e95943f57e036e412d442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082779, "uuid": "4e6325aa-5e40-4ff2-918f-43068e6f850c", "value": "T175864A57EDA555E8C0ADD13189B39613BB717C490B3023D32B60FA283F76BD06ABA354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082779, "uuid": "42749ff3-630f-416c-b604-81dca9480276", "value": "49152:V8M+q/H2c6MeLqLNLuXG+w7i4lnHW6sgWAUpvqkHZD8WetxQVe52yakUsZ+9NQP5:V8Mjv2P0eDZDEuZHkOeXj3gRBQUHEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082779, "uuid": "c5d3ce2d-23b8-477b-933b-6db9113cafdd", "value": 8405154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082779, "uuid": "88ba906d-108f-4fba-a511-05ed6487136d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082779, "uuid": "6ed57bc1-0415-40a3-8ad9-183f14b24ea2", "value": "svc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fe323d-2dc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Kamasers)", "timestamp": 1775046039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046039, "uuid": "045c6427-e697-4851-9e39-f1695e58d1ca", "comment": "Malware payload (Kamasers)", "value": "5bf8281b8139f05438aa817e1155874a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046039, "uuid": "71d2a007-b579-4c21-b49b-cc191d9513af", "comment": "Malware payload (Kamasers)", "value": "eb9252284ea46f9c5cd9ea330da0e44a2c0cd396498d651a2b749ae38795c50d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046039, "uuid": "5791c258-92f4-4411-aed0-7269218e9e04", "comment": "Malware payload (Kamasers)", "value": "9a70d618c86e0ca98419f46e737091aa292eb273", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046039, "uuid": "dd9411d3-cb14-4996-b693-0dd554c46ae6", "comment": "Malware payload (Kamasers)", "value": "074fb809a356ba053e686e1bffa336db1b6614f104e5888078fd6b3039ec979df0270db0b8b5a27d44e8526df55be0cd", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046039, "uuid": "12864b68-8968-4c57-a435-979c802cc0af", "value": "T1E0960233B28A673EF06E5B3759B292209D3B7661A41F8C5696E40C4CCF2A0601E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046039, "uuid": "f59a9318-fc54-482f-a305-e63b266cea5a", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046039, "uuid": "54a3ebda-b5f9-41bd-a373-b58887c25feb", "value": "98304:AN66NfDMvYXRLV97n33iMATAzcNxjr2YZX24V:UNbYMzNATAAdr2YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046039, "uuid": "6e00faf1-714a-4952-8f43-dd0559659dac", "value": 9043817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046039, "uuid": "0d37791e-965d-43ed-9bcf-c33ee839fca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046039, "uuid": "fbfbda0e-5071-416a-950f-afe412045327", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfc95c6-2de9-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1775061732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061732, "uuid": "b690b6d9-ef35-450e-aec3-f807fba0bd9f", "comment": "Malware payload (UmbralStealer)", "value": "8bbcd36eb837fc7b46ee83709c193e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061732, "uuid": "7f28b5d6-f4f7-4d98-bbfd-830f8e5c92b1", "comment": "Malware payload (UmbralStealer)", "value": "ec9e3a628623ce0ebcea6e5c230348474575aa991c13df8faac130bc2f442f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061732, "uuid": "502e5186-dbc0-43fa-96da-71d1c1d5ea12", "comment": "Malware payload (UmbralStealer)", "value": "054b5267c20dd236a23a428af125fda409bcd8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775061732, "uuid": "5f127128-1819-4bd6-bbfa-0890e0130b43", "comment": "Malware payload (UmbralStealer)", "value": "293aade7143c58db4e9054fd5f3cf8d48e0952f314b114bd2c943c44e5c1a1b288e06ff0062b94c228c8d8108904d998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061732, "uuid": "ea55ecec-bb25-4f42-92fa-8737c9a10b47", "value": "T1A0346B4933B88B17E25F8BBDD5B1158F87B1F143E90AF78E0C8895F82412B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061732, "uuid": "fab76c3b-94c2-4316-b965-b33911e7d2be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061732, "uuid": "bbbcd9fa-3a88-4d8b-baeb-27e98560fad5", "value": "6144:9loZMDXU9Zx0kt8X0/PSCsMZH9phv0IHl2PxM4dmNb8e1mFxi:foZnf0kkPQH9phv0IHl2PxM4dOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775061732, "uuid": "8484afa2-2bc4-4338-a784-e4486d1d372a", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775061732, "uuid": "7c994361-1768-4ff0-bde7-52b135aaa8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775061732, "uuid": "39adf659-2183-4784-95b9-1505852d94cc", "value": "xx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48a0f62-2dae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036380, "uuid": "042430fd-4424-4460-86dd-5b9c6bf50b9e", "comment": "Malware payload (Mirai)", "value": "190763d71b9d12f37924b7e22fcd6969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036380, "uuid": "a19e0fdb-fe26-49ce-903d-5527ace0c928", "comment": "Malware payload (Mirai)", "value": "ecd95ccc0840def85bead655f6ae24b5dac9bb325b9af49fb70667915f286089", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036380, "uuid": "b69fd538-7267-4814-9db4-b9eed492e74b", "comment": "Malware payload (Mirai)", "value": "f50c54127ce224d20364f6d139469ad1d88d5a63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036380, "uuid": "e8f559dd-87af-483b-bb11-0414ed82789c", "comment": "Malware payload (Mirai)", "value": "87f19e1905f3c72717216f64b25335a423aa24adab68603634fa2bc5c8437c1a2c356db539702494d88c432788902713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036380, "uuid": "efa7065c-205d-40a6-bd71-78bbde859520", "value": "T17634E70AABA10EFBE8AFCD3705E9170124CC551321B97F367274D914F54B68B8AE3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036380, "uuid": "484bd3e3-7a1a-40b5-8e7c-02b05a2b2e3c", "value": "6144:b4HrXbssxRd+m0TpVZSgq4OjEFAjULSt:b4H1xIRncEtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036380, "uuid": "a5824e1a-298c-4247-bb2e-6533b9e0fdcc", "value": 244124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036380, "uuid": "c3c6ce09-6386-4308-9bdb-956336a398dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036380, "uuid": "ac8ca907-7dc2-4724-92c1-d1e4c1a0905b", "value": "kurayami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcc766a-2dad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775035862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035862, "uuid": "516647c5-6433-4f7a-a017-d0337718c9be", "comment": "Malware payload", "value": "d3ae2d7f49d3235e67b2f15e7d97a0a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035862, "uuid": "5ebce558-0412-4cf9-8764-7597681657ec", "comment": "Malware payload", "value": "ecf508d91f7e3b17a7211e5e8d48739158cd75844f2caaf9792f95ce7d17516f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035862, "uuid": "f7755dca-5e2a-45e2-9651-f5ef1560663c", "comment": "Malware payload", "value": "db8819ae051c965ff77ce86d16ca72f4b54dfc20", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775035862, "uuid": "bc199225-66f7-4dce-8e90-cdc88bbc773b", "comment": "Malware payload", "value": "5f26f8603390c0582c8ff8cc7b963d154da6d01175ef10b51baf4c292b3d46e6f51eaae5feb6bf7cae0892b60bf41325", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035862, "uuid": "01b59ccc-2791-4752-8588-d1a11cf73a54", "value": "T1AF523F087311626595B26B3CCDC7981DFF3F507B2562421472DDA0802FB6A6ECBA8F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035862, "uuid": "ca4b85bb-6f99-47b7-9e3a-e4f57dddccd9", "value": "384:G5v38JWPShwHgTT38w+6388S38J8PDthwHgTFH3a+n1qqE:E38JW238wx388S38J8w+nlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775035862, "uuid": "0686f677-fc2d-4868-94c6-93f6e1fec645", "value": 13692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775035862, "uuid": "aac7d63d-863e-4d50-9e06-50bc8a77b545", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775035862, "uuid": "dae0a070-fa1f-45b1-836f-b8f87a8cc8e1", "value": "t.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b766c3-2dd5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775053239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053239, "uuid": "3524f1ff-ff28-4109-a7b7-c531e602d058", "comment": "Malware payload (RemcosRAT)", "value": "913e47a95d348fb2ef3e586b7a984f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053239, "uuid": "f8fc869d-689d-4f32-a721-61f2ea38c55a", "comment": "Malware payload (RemcosRAT)", "value": "ed85bc0911f7c89e2369490c7892caaff0caec9ee1ee132df99ddb1281596c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053239, "uuid": "9c6a8ce8-cffa-41bc-884a-97c3ede4c366", "comment": "Malware payload (RemcosRAT)", "value": "af508b580d7e35248825b7247e2a51e500dc2c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053239, "uuid": "eb0aeeb4-9cab-43b6-bbc1-3f2a79d7ee9f", "comment": "Malware payload (RemcosRAT)", "value": "b3ca34e76c17dc6919675b812d5d5d0b1bcb483476dbeb661f269aa8b89837594dad94ab8f8fd25257f0c60d18714441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053239, "uuid": "8f079f2c-d469-4d0d-8e91-a7c5ae10e092", "value": "T193A4221032F9C667D96610301C3596AF77EAEE560168A66B7FA07D8C34343D6C92F38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053239, "uuid": "99d1333f-a685-4bfa-bb74-2aec06db7238", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053239, "uuid": "6ef7c90d-c676-42cf-b819-78351f3020b1", "value": "12288:wgr88888888ZjV0pPBwQIbD3CRlbI0muW2htddccw:wgFBAPSQIbD3C3b/W2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053239, "uuid": "1c0e04cb-f1f8-44ee-8691-47bc37fd7d4a", "value": 474757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053239, "uuid": "04f4ffe2-3832-4dae-9375-ec9fbb4c6122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053239, "uuid": "648b50ab-ead1-4534-8256-de548521f150", "value": "Bestellung Nr. 24001680BE.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f67ca-2dfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775070719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070719, "uuid": "294dd11d-f6cf-4f9b-9ff2-29592793ff92", "comment": "Malware payload", "value": "e0d34c4285e457ef2a69d01e23b4a9a6", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070719, "uuid": "2c1ed6d1-a10c-439d-8aca-0d83efd4a4ae", "comment": "Malware payload", "value": "ede7f3ece611ba6c1ac4a02cf6a618b4ebd7eec6d9426b2baab3b5e26246e275", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070719, "uuid": "0053fb54-d2ff-4f81-868f-f56ee5dc600d", "comment": "Malware payload", "value": "9bf5f405fd26370268c85620b85a32dbca797495", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775070719, "uuid": "aaec4997-9058-4381-a14e-4580a10ff3e1", "comment": "Malware payload", "value": "8948d6fa4f49224b6bfe6fcc946f3f71b126e16b85949f0a11231f0392da18420e534c9539c8792f8b017070eb18ca8b", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070719, "uuid": "e6a12552-365c-4379-a928-596a3cc86864", "value": "T1AFE409232344A624C17AF2FA124B4B1CAF72FD51C3A507E63769906ECFB53115E25BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070719, "uuid": "816e0f84-2a05-4585-a40d-94ebce9f79e6", "value": "6144:3qBnkfzKkJ2C6D9PVQIygQd39UvPW55Sq0qR2GFaMwSI6z7WUjP:aBnkfzvJ2C09dqdNQP+5wS2GnZzSgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775070719, "uuid": "cec7f48b-1fc0-4a8b-ad7e-4d6766fd4ec4", "value": 673216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775070719, "uuid": "c83d93d1-b1e2-4a83-8b1d-9ec7a0766011", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775070719, "uuid": "73eb2738-03c7-4876-b5e5-49de28f5f445", "value": "com.apple.icloud.sync", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a2c328-2d98-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775026985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026985, "uuid": "8c7e09c5-c99a-4043-97e4-e79bef058128", "comment": "Malware payload (Joker)", "value": "3655736007f17bca9d698cc9b53ade95", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026985, "uuid": "b745d523-7c52-4e24-9f7e-aa83fb0cc3f6", "comment": "Malware payload (Joker)", "value": "edfc2889ca89f723ad839165436b9418262463fe98d9350da20db313ca2b242d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026985, "uuid": "15731fde-98e3-42b9-a0b0-675aa7698393", "comment": "Malware payload (Joker)", "value": "179a76d44542659a96ad241fa357891db2a22796", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026985, "uuid": "2a2cbe60-8962-456e-83ba-0dc7700c3659", "comment": "Malware payload (Joker)", "value": "f213e2030ab5a325859b9c2363159ca9a477616b6def8630f7972dbbf658dd63cd8f96dd16dd47a3fcee618846c6be6b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026985, "uuid": "eee2544a-26a5-4abb-9c30-3a9f0929ab71", "value": "T1249602D6FB88682FC8775036CD6922B1424B1C265A43EF877818771C68A79D84F1EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026985, "uuid": "a17e2ce8-9d54-4889-8eb8-4c4fce5d741a", "value": "196608:lkLvICJWybq5NpOw3eYG1a8D1a871a8+1a8e1a811a8W1a8T1a8C1a8u1a8V1a8G:wvIKHm5NpOV1E8DE87E8+E8eE81E8WEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026985, "uuid": "c5e56ecd-609b-4254-be5d-32819fa82ae5", "value": 8821750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026985, "uuid": "bb36423a-d5d0-49af-8e40-df7bf76f8980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026985, "uuid": "9779b21a-3677-434b-b3f6-fac93a8ca9b4", "value": "com.fastmsapp.deftextsms.messages_0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182f21a5-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053297, "uuid": "c537d41e-252f-4565-83ee-50ce506d43d6", "comment": "Malware payload (Mirai)", "value": "4792ebda1e56ec53eda63ee32dd63b01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053297, "uuid": "a5e3d96a-e5bb-4427-a6b4-28317a47ce9c", "comment": "Malware payload (Mirai)", "value": "ee656f2bdca81a937e8ff706351d16adb4851342c48b6d81c929bd5f61c7e238", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053297, "uuid": "ae5cee2a-1418-4fe2-b6a6-a34aef412e84", "comment": "Malware payload (Mirai)", "value": "deda19cec6603d523928b6455446e162c615bba4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053297, "uuid": "ce1b6c77-86c7-4f32-a8f0-96d9a5b8195c", "comment": "Malware payload (Mirai)", "value": "c6d3b9cea5768679a2f21cd568840f737ad08ae523dea3146be8a853d3428b87fbdccc66cb250e4c0112e60d0ea354d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053297, "uuid": "ae043f38-427a-4125-9740-16c9fb3cfec4", "value": "T1D353831AAF650FFBEC6BCD3745A91B49349C640A12E93B367934C818BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053297, "uuid": "004bb6d0-2c19-4099-8ef4-b2281eade461", "value": "1536:yGtQ8AKyjOz8lI4DXUAFsMSL3bKL2LZgsF8qD:yM6KyazQJDU4L2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053297, "uuid": "d8ed7781-7b90-43c2-a3d2-6e18a8587552", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053297, "uuid": "c5a17352-25c5-48fc-86a3-cb9a7e16cdd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053297, "uuid": "27b2e5ea-87e2-4685-8a07-62802bb6f9f3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04513cc8-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028353, "uuid": "3b20b85c-a4a0-42ee-9813-f42699988a25", "comment": "Malware payload", "value": "fc3fc931e603a6c18c6d8f339b08f765", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028353, "uuid": "9319a4c1-8795-4083-b44f-97d3d9c6e213", "comment": "Malware payload", "value": "eebf8bbabc8d107c292f0d94b2ae8e40027313e38be52c9a760551e92633d577", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028353, "uuid": "8a1df2a7-2e30-4a5c-b9ed-a6b0ed14ab47", "comment": "Malware payload", "value": "383eeb03b7bd3209222205f703e5f3a2c57ba660", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028353, "uuid": "eb4502ca-755f-4df9-bcd4-552e9a4dab88", "comment": "Malware payload", "value": "a60172ae6e9e45867faab3d87381aa3cf718509bca627510e4677396170c03e7e000a619df76989b7f39df7546dd639d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028353, "uuid": "82445d4d-a176-477c-9f1b-0bcaacbc4f4f", "value": "T1602401B782C9BD7EC88D02F74863B5B0F25A0C0BAAB0B4517A035BCD8D9855E06195FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028353, "uuid": "d7b400ce-1156-442a-888b-003876820439", "value": "6144:3jHxktl5lNXlEMsBkUK1pownvPo1zdDcNGKkje9uajeS7A:31ktl/NXlQBkUK1DvgddDcNGKAeAaje1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028353, "uuid": "591773a1-fd09-415f-b6b8-0369dc51e24d", "value": 228599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028353, "uuid": "517ef561-bd44-4bd7-bb68-e041a90354f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028353, "uuid": "a8dda92f-def3-4069-be1d-459298d170e3", "value": "doc098763567890.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbceb6e1-2d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775022702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022702, "uuid": "f914a643-62ea-47a1-8f2e-cc4c101d4df6", "comment": "Malware payload (Mirai)", "value": "114aacae8bfcd35144d0310b200a7f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022702, "uuid": "fae77900-cb9d-4393-9166-c628faf59311", "comment": "Malware payload (Mirai)", "value": "ef56d34e58e50cba0f66b1736b6c9efc2815fdd1c78d4d703259540bf3a67e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022702, "uuid": "20d841e3-7aa6-41ad-81e4-4491d1cda159", "comment": "Malware payload (Mirai)", "value": "31c6d16858cbb48a1114809c4a5421e5d2270bff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775022702, "uuid": "cdda68db-a46e-4f84-a9b5-54e6ba4da355", "comment": "Malware payload (Mirai)", "value": "2e009dbf2131f24ef1ca44335fde783718637155d2167b129bb5a4dec0fedb8ee2bc2527a2af11344ccf1521ddba9905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022702, "uuid": "01ee66ee-7307-4f84-be7e-0b589783fdd7", "value": "T171330881B8C29A23C5E4137AF56E458E376467E8E2CF7217DD221F603AC681F0C67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022702, "uuid": "9f7267f1-157f-42bf-b3b2-0bd4a30a8e8d", "value": "768:OrNhbPk0XgKgNt7vIQctxVnj1NZQ4MOOpyymmmndrcttNL/7ETY1Roj8QlwE:sNpCvIQ6Vnj1LiOOpCwtNXETYky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775022702, "uuid": "77a2c795-628e-4811-ba45-b0ed8d3692c0", "value": 54584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775022702, "uuid": "2595d319-91ee-4328-beb2-83c28cc35ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775022702, "uuid": "cd9a9fd8-93a7-4ccd-af82-55a94b55806f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb0a13-2df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775066658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066658, "uuid": "2589ae3e-a285-4c88-8d9d-408effc37605", "comment": "Malware payload", "value": "f206d9cc12fe4ca429426e1316f437f2", "object_relation": "md5", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066658, "uuid": "764aa4b3-1b3f-4c85-8025-387d111cc610", "comment": "Malware payload", "value": "f02758a235a220f2fa125bb6f45a49e674fd8b91f320a382e8b7017d93afbc74", "object_relation": "sha256", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066658, "uuid": "5b64f6be-897e-4dd6-8fe8-cc90cd37f1ca", "comment": "Malware payload", "value": "ccd3cee2284df80eaa742d8de63307a63aad207b", "object_relation": "sha1", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775066658, "uuid": "eac9917e-4e01-4fe4-be5e-bec3fd793f10", "comment": "Malware payload", "value": "ca5abdeac555173f61e5e5bde820b5bd402f4d7f501e4ead5983b6d294a7822c0e00fd70b95558a33eeb6d861871f39e", "object_relation": "sha3-384", "Tag": [ { "name": "datasphere-us-com", "colour": "#AA976D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066658, "uuid": "92a2fce6-fb81-48f5-b971-90457bc96e9d", "value": "T1A243C8077961273FE65DC70AE19409FC975AC35D422BF17D82DED02F180DE8EA6329A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066658, "uuid": "d8f168e8-c8d2-473a-a6e3-a3dd30c8d140", "value": "384:/8KO1MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGvc3Z8thTLpfqz+DfTTb3oLnai:COOq58H8XtO8fpE3Z8jLBqPiozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775066658, "uuid": "45d9ece7-36f5-49e1-8f18-ade7a4fd1d7e", "value": 57709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775066658, "uuid": "9a0890e5-c69f-4455-8e93-e7d7475fa36f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775066658, "uuid": "aed22c9e-1e59-4634-b51f-2b75d1fb06bc", "value": "f02758a235a220f2fa125bb6f45a49e674fd8b91f320a382e8b7017d93afbc74.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6132d128-2deb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775062439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775062439, "uuid": "d0e234c7-667c-466f-859a-fc0c9be7e5c6", "comment": "Malware payload", "value": "d9ddcb28e1453621739e3223e2ec2d30", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775062439, "uuid": "9aac6c9a-1500-4e19-a61c-8736af75f4c6", "comment": "Malware payload", "value": "f0ab014ed680c3cf156e236be873ddc45a9954dd059f6fecbdc2b5821f8498fc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775062439, "uuid": "ecd6d9ba-a6e5-425e-9b14-0f9599b38927", "comment": "Malware payload", "value": "ff22884050938e8a12cc4c66594ca393734929ed", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775062439, "uuid": "5b1c883e-2f16-4f54-9e1d-ee69070cf866", "comment": "Malware payload", "value": "87285103c198d2cddb088ec66a03a17e798701eb993c192f2ca82ed9022da990dfdda43a9d309e11e79234748f267d21", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775062439, "uuid": "c043089a-4bdc-4ce0-82b8-e5125c67bb7a", "value": "T1FE34D0CFD67652E098D2B76B010136920D38D849C759274E26A5B5B1B7F7C3A3C0FAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775062439, "uuid": "9a7c08bf-1b4f-4e40-82dc-a240e6247e83", "value": "3072:uHzmNdcDh4d5NLYpsn6xCGo36ZFCntBUUL4Vf4QXclpc0:KiNLYin6xS3KFozUUL4Vf4ocH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775062439, "uuid": "cf19245c-66e8-4bd8-b8e3-52b4f9eea60a", "value": 246309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775062439, "uuid": "b77fb41f-259a-4318-a684-b15486c2f13d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775062439, "uuid": "509550f6-c046-4db4-acb2-ef970d0f891d", "value": "SecuriteInfo.com.Trojan.GenericKD.79593986.14392.705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277d80bf-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057618, "uuid": "f9f8a083-e9d0-4444-a589-b90d71c9d755", "comment": "Malware payload (AgentTesla)", "value": "fa2e38204c5d34bb12a6a20e5f3aeac7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057618, "uuid": "b982836f-461d-468d-b02b-e158cf0e77dd", "comment": "Malware payload (AgentTesla)", "value": "f0acf635a7116bbc790de55d7b6cc366b67ca02a717c15420d2a7f3ab33f0ebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057618, "uuid": "f6870434-a95e-4a06-98a1-9b41f8e5227d", "comment": "Malware payload (AgentTesla)", "value": "5875dc7db02aa70628073a5e8a164d4fec417601", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057618, "uuid": "4991ae58-c27b-4461-a5c3-1812cb5a9e7b", "comment": "Malware payload (AgentTesla)", "value": "559b1799bee83df00551fa7d733953fb02ab22bdefb076acac8c7707cc60f7c2a7345faa9be4b7fab07b5094437e870f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057618, "uuid": "486fbcf5-ae6e-42f6-99bb-01bb7d4039ba", "value": "T154645D60ED3412678E9327ADACA859A1D9FEC91A913740F5F7C9030E61016FCD37E26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057618, "uuid": "fc471984-596f-4f4a-955a-5f49288dfae9", "value": "6144:2BlIn9q2g5G1Za8LZ/KrzlcQ6EKL7Pz83P+d/:2BlIn9q2g5G1Za8LZ/KrzlcVEKL7Pz8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057618, "uuid": "a05598ef-6784-46a8-947e-3d674d164687", "value": 318460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057618, "uuid": "c509f911-0371-40ad-9130-af6c25632d11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057618, "uuid": "1c6670d4-52e3-414f-b4e3-3e21e3132350", "value": "31032026001836.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999beebe-2dae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775036334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036334, "uuid": "96dcf776-24a6-4660-9352-2fe7cd275d4e", "comment": "Malware payload (Mirai)", "value": "1b5df7f93f5a786bb9ae8c015844f0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036334, "uuid": "8ea5fcb0-7644-434b-abb4-daf8dca726fe", "comment": "Malware payload (Mirai)", "value": "f12da0de01043970050d584da976e34c8b4b8d32739a385c68ba1f5522ea99df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036334, "uuid": "d7227aff-fab2-4e4f-97a0-6f97289c56cc", "comment": "Malware payload (Mirai)", "value": "1dc7b2ae3b3d357a4490f3a1fa017e959a1e7053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775036334, "uuid": "98a02ea4-06ed-4673-9412-fff548463516", "comment": "Malware payload (Mirai)", "value": "f6f49ab03304bf7305e858e7d4164fc3d8685f56c0842360bc024f755ec26e36ccc0d4f93a5173aa170baf583480542a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036334, "uuid": "d0db79dd-77d3-47f5-a5a2-5ec04b4701c4", "value": "T13373F25DA92927D0C5310E34E49C36616D3AF5C00239CE5D632DACF9FE0D877A2661F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036334, "uuid": "102f8e41-af76-4a22-8e03-f3e7d8f4c5c6", "value": "1536:HiNnqKxdbnutez1ehkEwkfR0GyV96XNTrloRbis:CNqinuuehrw00Duds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775036334, "uuid": "279fce29-23a4-4d6e-b23f-1214a790f50f", "value": 76060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775036334, "uuid": "05fcf85f-1454-4952-9aa2-cc86b68a7c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775036334, "uuid": "9fbc1fdf-0e09-48fb-8753-74462b99c6bc", "value": "kurayami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9cba6c-2d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028578, "uuid": "304c9a8f-6ec5-479a-8498-6f1d4f8b3bea", "comment": "Malware payload", "value": "14495ee71ced79620f59a8d783d357a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028578, "uuid": "10036d32-9ac8-4a29-90d1-a2de426599c5", "comment": "Malware payload", "value": "f136a2ee092599406a45dad03ef0ad6277aa93a11c19463fabf6fab831237d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028578, "uuid": "d90dff1a-67a7-45a4-a07f-c6c3b8c2799b", "comment": "Malware payload", "value": "30590e2f80543958da12c0813696f0d1fd591f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028578, "uuid": "1bceb79a-c348-4e2d-85b0-6a94a20c04d1", "comment": "Malware payload", "value": "77d38b57bd8e0525e50abaf12950201a32432eee1eaf5c2bc2a93aec45180fae58f1d5d0e6aa6e79bff280133b258295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028578, "uuid": "bfd68e77-060a-4f67-90bb-51c8acd6d4b6", "value": "T16325D010AE976A68F9990F78C01204A977F4D4132657EB2F2FFC40B9ADBBF94CD1A411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028578, "uuid": "cd91ec13-b59b-49ca-9a1b-2bb945c19967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028578, "uuid": "106043ce-f47e-41b9-bcb1-6d6aaa12886c", "value": "12288:7cwxF37Pl9/0JSyLqgRSuZyOfP0ZLZ5Wr2YI1Qsc6F3lrK/CD0pb:7cwxF3P/0J7hsu9sjF3leL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028578, "uuid": "9e90e04a-2077-4e9b-8aec-54ddbb7b13f5", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028578, "uuid": "d7b99aac-5b84-4623-a40c-a12ed5ec9a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028578, "uuid": "ee59ca3a-7e8f-4553-acb4-0de0552a0646", "value": "13-03-2026 -T\u00dcB\u0130TAK-SAGE-TEKL\u0130F \u0130STE\u011e\u0130 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b892f-2dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775045952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045952, "uuid": "a69a1508-e7aa-4894-ada7-277d3324be00", "comment": "Malware payload (Vidar)", "value": "9c5a7f688841f8762dffc84cfa120459", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045952, "uuid": "012fb1c8-04b5-4749-9851-150a6cae9b34", "comment": "Malware payload (Vidar)", "value": "f26119470f6a040c7dfc591ad4ed4fd909a96cbeec705d0745998ee8ad023b3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045952, "uuid": "393be0c6-dc95-4a03-8f05-371acf4a41ea", "comment": "Malware payload (Vidar)", "value": "c95a598236c7752f748aa7070dec60fafbb69a20", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775045952, "uuid": "1c327981-98f6-4ce7-88de-c725d7782bc4", "comment": "Malware payload (Vidar)", "value": "9ff77dbb616b3daf01d59989323acdb4a34d8b9d08e9fda95fccf748bd7a94df72fb1e2fa5d1408d2acdcadac5f4c3de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045952, "uuid": "dd8fd4c2-e29a-4f37-80ab-11257208263b", "value": "T1F9856B23E8D542ADC4A682F0CEAF1763F371B41455121AAF1390DF956F7ABC09B0E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045952, "uuid": "62d00c0d-0543-4c86-8343-4678b6b23ffa", "value": "816120f8e921805f79f1dc53b6944d2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045952, "uuid": "53933dcb-9334-4e47-87e0-af7bb5f174d5", "value": "49152:Mn+HpyQWFfZUlyGL44sSQ2BEM199+vwly7wx:u1Uly6y7wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775045952, "uuid": "db27f8e9-489a-436e-9802-00c9684163f5", "value": 1717480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775045952, "uuid": "9da04ee3-8174-43c5-a907-6611fef46a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775045952, "uuid": "21b01d8a-2224-4b13-a286-f151d4d259c3", "value": "libiomp5md.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17404d12-2e16-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775080783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080783, "uuid": "2fedd182-d6ca-4319-91d6-f37417b80b94", "comment": "Malware payload (Mirai)", "value": "27eaa461169cfb17d76dd38993534ac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080783, "uuid": "2d9554ce-ada6-4161-95a7-4c95542d96f7", "comment": "Malware payload (Mirai)", "value": "f2cab18500acd57996c05a68f74d08badcc9518d453d9d0ee1e3d8ae0ac3b345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080783, "uuid": "66bb36e7-ae92-46b5-9352-956eaa9e78fa", "comment": "Malware payload (Mirai)", "value": "506e1a2f4371a4eb8e0ee35a3c24b5d68ec7356c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775080783, "uuid": "f3b047ee-ca76-47fb-8dcb-41fdbedad030", "comment": "Malware payload (Mirai)", "value": "d54c9e708198026927455eadf505edb8a11788304e47c3491eaa4b16033f9092416892623b366c5499d5b8c2e3912b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080783, "uuid": "44d8f047-2e31-4503-90a9-b4bc58af625c", "value": "T193937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080783, "uuid": "32ef6a07-3029-4922-bd04-dc2c80548bf8", "value": "1536:W/QCZaxGdvts3i5JPhoTIxPu++ALtgUIKqI4FrS4LSc:WYCZa8dvm3oJPhWIxP5htSKfUmDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775080783, "uuid": "0d14de0e-4f2a-4dea-9e30-fb4cb1a2f2cf", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775080783, "uuid": "bf3bba32-984c-409b-827c-ae292475a68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775080783, "uuid": "8ec33668-3faf-4e79-b59a-b91122a455d5", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0bab19-2dc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1775046563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046563, "uuid": "7e4303d6-5d14-44fb-8ad0-2b98e4052c69", "comment": "Malware payload (Adware.Techsnab)", "value": "cd5d9c286cf92bcff10387f9bef88b93", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046563, "uuid": "f8531eb1-fc22-4df5-9048-0df98059bad1", "comment": "Malware payload (Adware.Techsnab)", "value": "f3b86b6587466afe8b515c08e31c9bea44ccfc3a795de0095bad2e8ae74ea2d7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046563, "uuid": "9fef89f9-1d28-44c0-a9ba-697874f3f050", "comment": "Malware payload (Adware.Techsnab)", "value": "38c72c6e0393250fd58ec7a46eac96e34b1aac32", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775046563, "uuid": "9a0762b6-0fc4-49ad-aa72-d3ccf9ee8c92", "comment": "Malware payload (Adware.Techsnab)", "value": "7f12935c6d8e144f6d1ee17e3b92f82155f552a33b28c5c2189f5c4788df4cfccc4ce5b9001c63336f54ee04356eef56", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046563, "uuid": "ecd1d7a1-1869-407e-a0e0-ad34f51b3e07", "value": "T13333A6D666FA1F46086BCC0A9F63888919BBD984802D8531FC139E1BEF77CE53D63452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046563, "uuid": "6a955a3a-8db2-43f4-b1cc-fa80549cecaa", "value": "768:RXUFgHV0xoqLVWHw14JhI6xUdrVnfQi7oDhtqGOpqCLo5WmxcfgQPB4OYF:RX4x/iZxUdrVnYTDhsaIo5WmxGguB4BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775046563, "uuid": "88a3e43b-9777-433b-b83a-c2dd8589f994", "value": 52741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775046563, "uuid": "ecf3f152-5a32-407c-a429-f0a80fe7cf7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775046563, "uuid": "d17b8bb5-8932-419b-a2c0-dbc90b887fde", "value": "f3b86b6587466afe8b515c08e31c9bea44ccfc3a795de0095bad2e8ae74ea2d7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d595ed3d-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1775053615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053615, "uuid": "7606517e-190a-4843-9133-32c5fe6e72ab", "comment": "Malware payload (STRRAT)", "value": "7f0f810ff37fa55553858aeb0323253c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053615, "uuid": "9cff82cb-c4c9-41a3-bca5-05dacadb824e", "comment": "Malware payload (STRRAT)", "value": "f525c77dc8080ee628c49bb3e2df056a65a26d5afef5290323ff38bcb2130b30", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053615, "uuid": "41a84b50-2e2a-4738-aaae-fc421cdecdec", "comment": "Malware payload (STRRAT)", "value": "64dc79335388e6c9a47f58067c90860837cd59bc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053615, "uuid": "769bbabb-8aef-474e-a7f9-9e65cf23024f", "comment": "Malware payload (STRRAT)", "value": "a01ae17934e6d071fe5fc702d10a2f237cc825578a7ff9da92fcbdf6adf9bfd28fb37052776d5fa5e7fa0218fc7bd6a4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053615, "uuid": "5ce89757-5e51-4d4b-9668-01207a4fbc6f", "value": "T15A5383447BC0D07AE723F0724A58960AFD74F4EF92556A870EF0ACADECE98440F52AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053615, "uuid": "96d544a7-a90f-458a-8eee-8fa90592da33", "value": "768:FxwyTWZsRWQ8mhAL6W3HDjTHNMcLLWxG6h4iyHSF0SD0O9jn/7wlxHS:gyTmQA6W3HHrScLLqhhqyFsOh/7wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053615, "uuid": "ffd83e60-89de-4a0a-9292-af96e4747816", "value": 63596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053615, "uuid": "5453f832-bdde-4c3b-b27a-babdb838bfc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053615, "uuid": "b6263eac-bcb7-4158-a742-49aa76ddecfe", "value": "Shipping Bill2008581 dated01042026.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e1fb36-2ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057526, "uuid": "05350368-5af3-4c86-8193-07ebafbe4ff6", "comment": "Malware payload (AgentTesla)", "value": "937e290ba144981fe7d05786d8723118", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057526, "uuid": "13987721-4db4-4f59-ab94-5ebac6a0c506", "comment": "Malware payload (AgentTesla)", "value": "f52a4fd5c912375ef53a2612cc97cb445816562d408aebb37fc7f973b656ea9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057526, "uuid": "07b63164-1640-48d2-ab63-1cf6e9adc276", "comment": "Malware payload (AgentTesla)", "value": "33168c0d8acbebca25cec3bf2b9b6846c7ccad67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057526, "uuid": "68aed655-205f-48a9-bde5-1592c7854200", "comment": "Malware payload (AgentTesla)", "value": "0977a9fe26128201e95150ffb0d3fcd764d366da4282b94eed6095662ec90a053dde840b79c6398a8cf3639ed3725b82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057526, "uuid": "e11930ba-bb07-442b-bf82-978a6eb9b7bf", "value": "T1FA65F22589C42FB9DFBC5A1D80FD161A63F04E8E4465798AEB33BD47AFE7A00510B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057526, "uuid": "48c09d64-804b-463b-8fad-ef1b5d89280e", "value": "24576:2Os2WdA8w5e2u0SU/uHboUCnfhe4NGve4aTuTB7xMa7p6qW0qkO0GeJRdY:S2l8+n89C0+O3iKdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057526, "uuid": "0c6bfe9d-c844-4148-b005-5119a386aa54", "value": 1449165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057526, "uuid": "de1d64cb-2592-48a8-8117-7ba59889d02f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057526, "uuid": "3d241d06-afb2-44d1-bfdf-c76add4fe2b8", "value": "Detalles de la copia de pago____________________pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d096047b-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (ImmyBotRMM)", "timestamp": 1775053607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053607, "uuid": "ce1b4e5f-45fb-4fc2-80eb-7ed762e31a14", "comment": "Malware payload (ImmyBotRMM)", "value": "1727fda7a64f0f064369bb25573b7869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImmyBotRMM", "colour": "#EC8680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053607, "uuid": "9f457cf8-1567-448e-a9e3-7245c72ab355", "comment": "Malware payload (ImmyBotRMM)", "value": "f6b6d19a1309918150b3597f84e247b4b0a979f6ba902957e8caee57837f44aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImmyBotRMM", "colour": "#EC8680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053607, "uuid": "51b2674e-c1a3-4c8c-a249-05b9a24ccdee", "comment": "Malware payload (ImmyBotRMM)", "value": "63fa715abb3fc2e783c0f20d461fe2a59d6460c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImmyBotRMM", "colour": "#EC8680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053607, "uuid": "9845300e-4601-4cca-b8a5-6bd50c748678", "comment": "Malware payload (ImmyBotRMM)", "value": "8dac0b29807c1f4661045499b43c15c0f60964d3ac1058d1cb8dda06c686b900ed40f9058c08ab7c1a9f1dc7b470b5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImmyBotRMM", "colour": "#EC8680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053607, "uuid": "232ff2fa-c4c1-4d2c-a82f-535c58709b71", "value": "T126D7332378D4817DC1BA397292AC1324D5796E006220DC2BF754B72D1F707D2E5BAEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053607, "uuid": "2ea26781-c4c4-4679-84be-ab68bfbecba3", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053607, "uuid": "358e3fdc-aded-4ac6-a947-9e2c040e96b7", "value": "1572864:KfZuG1aIP2RQTxUAWkCmk29tLgKUAfWmz4vHerRvDN3Mel4Yb:qZTZOyUBCLNUAWPvoFN8eOYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053607, "uuid": "3544af7d-9cef-4792-8a3d-acec51c0b250", "value": 59472168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053607, "uuid": "ae116a88-3cdf-4d1e-a155-9cd319f2d793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053607, "uuid": "90343c55-bacf-4d93-92c4-e7a59881d78a", "value": "Finance_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f765457-2dc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775043834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775043834, "uuid": "b6da1586-0d11-4d83-91e5-191ec0595ec7", "comment": "Malware payload", "value": "20628a2a8b473445bd2684c9dfa7deae", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775043834, "uuid": "b6de820c-67ad-407c-af1f-1fbb59350ae8", "comment": "Malware payload", "value": "f6c1811f2df254642e3d3b4f9898ad89100c011c2f751f865d8059ad5cdb2372", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775043834, "uuid": "8e220df3-0ee3-488e-a849-890e398e8bee", "comment": "Malware payload", "value": "608ce5d51ecd7d8421acc551c92f794b2eaf532e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775043834, "uuid": "788a78e3-4ae6-4401-91de-78024585fbae", "comment": "Malware payload", "value": "e0371d9bb83f01a2807f9096feb70d35e1175814cb5e63fa28fc801e596b95a09cf6a7fc64f76f743e65680f943f64a4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775043834, "uuid": "6e992545-f3bd-4047-9938-3c2ba5d64c01", "value": "T19E42B8996EAB8747603CEE1E909F0594D143A7BF33B5A09D51883E780EB273DB92D14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775043834, "uuid": "fe737883-dbf3-4e65-97e5-b9bdab8f340f", "value": "96:YkNnZyd8rvetl2YtrdWdrNnc2aPNYy1vbydKoNsyvXvbdY38gPdxkydKSypqWaul:VduhCctMM0DFkqNFLZZbr6mi2La+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775043834, "uuid": "8e0c67a3-e07d-4722-abd0-ccfa968284f8", "value": 12685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775043834, "uuid": "c15d5e2a-c2fb-4a3f-b5f6-d0b1f5488c16", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775043834, "uuid": "0bab9d9a-3846-4824-9b55-94f5e862f088", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ff73e0-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053622, "uuid": "c6b3c950-f292-4461-8ef4-cc7255209649", "comment": "Malware payload (Mirai)", "value": "ad9b9623753358eb33f589560ffd97f1", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053622, "uuid": "cb12b88b-f054-4fbd-a11e-29b0fd5b0d53", "comment": "Malware payload (Mirai)", "value": "f722fa53c615a7655cdd2d6d9b7c0dd723de234d3fa6d9a573d5d728a6daf894", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053622, "uuid": "f2719a94-ccd1-4315-b4d6-e60102b43101", "comment": "Malware payload (Mirai)", "value": "b0ec398eddc362873212a7732c11274b9af5f532", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053622, "uuid": "a2d8706c-7888-4eca-9fd7-647aaefca9be", "comment": "Malware payload (Mirai)", "value": "bc6c8107b34733663ae9bf45f1a8a6408e686123d3e51f7b39c8f411450b97f552c183aca8693cf5ea3d0c43b7a6c08b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053622, "uuid": "5aa99818-b71f-4a80-8350-b737ff4f9321", "value": "T15D5302F7A0D87ECDC1599774050B464A3EC172786096A63AB2C0F6688BF2380DFD8BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053622, "uuid": "30a634c5-2823-42a5-aa5d-c5ecfda81eaa", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASApgLkg4azHy:CM5az1Fy0oPgdZX6hTo8RSgLGazHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053622, "uuid": "2380b987-ce09-40f7-b0db-c70867182b2d", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053622, "uuid": "c5e09a5a-2103-43bf-8021-0c4316399a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053622, "uuid": "6cfef597-80dc-42af-a489-1e4e0e6fedbe", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5a70ce-2dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775041651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041651, "uuid": "8411bbe6-53c7-4061-a5c2-5bc72e1743f7", "comment": "Malware payload", "value": "05fe0d372f6e6bf3e92a83c061299c6c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041651, "uuid": "b93bbc24-92ec-4c10-94fa-3cdf7bb08907", "comment": "Malware payload", "value": "f75186f51a4ed00d24d07434bc8d1ea843680c0920d5952e06b64c6b24361c9b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041651, "uuid": "3ece2eca-0140-4632-ab57-bb78ed6f0343", "comment": "Malware payload", "value": "73d98a82bfd730c11f1eb4316fc64c6040969af3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775041651, "uuid": "a19186c7-0af0-4ab2-88a9-87ebf861f993", "comment": "Malware payload", "value": "d1cf4f25b743617f648806f9295d973c3de855713da49258c22b54ef7a655a50c8005368d21aa44ec3fbeebc4e0ec17a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041651, "uuid": "2e83c68c-d65f-4af8-ba17-206655eb5055", "value": "T14D772373F728CA2FC8BB01700CAB7231661A5E15CE82E35B6908775C7A779D41E89BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041651, "uuid": "1bb52ba4-e35f-4b0d-b2d4-b040619fa36b", "value": "786432:78zGthrhIOzD/mSFTq+P9oT6H3bI/5zXuT3Z49X+EQzoEYNX:gzMhrh/3Xq+P9oT6XbI/5zeTmYPz2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775041651, "uuid": "3ddce430-3e62-4744-83de-becc653598a6", "value": 34661069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775041651, "uuid": "92abb42f-05d4-41a0-b2db-dc1bda44f6a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775041651, "uuid": "f0f5178f-56c1-4be7-a1ed-0ed30f67a8e7", "value": "taptapsend.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3da6ba-2e18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775082000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082000, "uuid": "2e392db1-a791-4496-be54-c767f1bcaa8d", "comment": "Malware payload (Mirai)", "value": "6fc4228cb8868661ea4510e5db43de13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082000, "uuid": "3a9994c3-c1e4-4cbd-81b0-1683cab6bba0", "comment": "Malware payload (Mirai)", "value": "f7c3f7f576203c39b4524a46da6b7693f83b58efa5da9b0c3d63ad8e878b3b6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082000, "uuid": "3a97415b-1cc8-4ff4-b61e-1d0f0e4b8b2a", "comment": "Malware payload (Mirai)", "value": "e8de712e7d823e804aeff4d8f26db2719a08e454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775082000, "uuid": "70dc9cb8-9f1d-4382-a59f-35db473a9ab4", "comment": "Malware payload (Mirai)", "value": "240da63b9f175ab9843027310cc59cf09c3721124624188d3be6c71e7f85a254b649d533202608b8b81a4199c2c742a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082000, "uuid": "c8af521b-7752-4301-bd70-975327358c49", "value": "T1DBE21A13B1280B2FC8D20230142E47954BBE96C556E4B5CFE67F57B21AB1E2A2C56FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082000, "uuid": "6d884923-cd36-41b3-a91a-55236d01d736", "value": "384:tQb9H/kqRo+IRIqgW98hgRTDPDuUT4ufXctw3BS8gE8v7N7bAodvc2hQVZ3w7zj:tEGPRI88+RTttk7zBhQVdw7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775082000, "uuid": "4746ec5d-3afe-41d9-bd1f-d3ec3c1cf2dc", "value": 32344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775082000, "uuid": "6fd4c04d-d9bf-46ef-90ca-e6b0fbd152c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775082000, "uuid": "1565dfb9-a4f0-4c63-bd72-65ea760b0eb0", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa452a1-2de0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775057731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057731, "uuid": "53456b44-84c7-48cd-8f4c-f609bd257317", "comment": "Malware payload (AgentTesla)", "value": "f8f8b0ae71c1a8c32336e5d18694cd62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057731, "uuid": "fefc4432-9d4d-4145-adac-15dafde634bf", "comment": "Malware payload (AgentTesla)", "value": "f84c291e5630d464bf970c4f9197c2181abc7fdf7e6d829de35269c54efaf58b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057731, "uuid": "c6ee18eb-83e5-4899-acdb-5c4a99af8fb2", "comment": "Malware payload (AgentTesla)", "value": "c68179e05e4487ae7a42ae030343cd4c36a5ad50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775057731, "uuid": "8a3612bc-4684-4a16-b4e6-ffc482789e0b", "comment": "Malware payload (AgentTesla)", "value": "0ed7484fae675fe489eb16f2cd67ac434087812e25069f8a3a14ef59e69d25eca4ed97aec3a4087deb2a04cebc4b9fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057731, "uuid": "b5a6a3a5-f559-4235-bf6f-a6548448a293", "value": "T1CC65021189C42FB8CFEC561D80FE160EA3E05A8E5456B58AEB33BD47AFF7A04510B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057731, "uuid": "38b8646a-d26b-4ae9-a5d9-09cc2cc5e0b3", "value": "24576:LGMLFgS7Dts1z2xzRXyVAOqMOfVPoU4NmVr8HQ9kkTmJB2:LzFg+ez230YjMNdZkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775057731, "uuid": "f5bbee89-a999-424f-9d02-eee4dc864645", "value": 1481317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775057731, "uuid": "4d219a8e-3f95-4d04-9ca0-70bad0389e74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775057731, "uuid": "7fca9ee8-9968-4450-bc05-498fee8808c4", "value": "Transaction_Confirmation.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa299651-2e1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775083741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083741, "uuid": "ff44e3ff-5cb9-45bd-a65b-8e953bab3dc7", "comment": "Malware payload (Mirai)", "value": "a6b3467c5712207eb73b25ef9d400496", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083741, "uuid": "8552e044-da6a-45fe-8902-a3ee411f1e6c", "comment": "Malware payload (Mirai)", "value": "f8e2d3a3a3db818c52bf4dc4ab6ba9ce6e8195cf1977ff13d889eb635d7c81f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083741, "uuid": "a0385283-d57d-41df-85e2-b40e036d4d26", "comment": "Malware payload (Mirai)", "value": "105e2b5742689ef0a1cd76e7bd232eb007b8a76f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775083741, "uuid": "9a453bc7-d320-4866-a780-bf5c39774f7d", "comment": "Malware payload (Mirai)", "value": "8f0c331efbf14227fff5c29038b5b29535937a58d899735a7d673d5a37801233ff16484f7429c4ab66101f44760be759", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083741, "uuid": "7a1d4a4c-e69a-4804-a70e-6c5f2b2a8107", "value": "T10CF002D7E285043B6CB901F3DFC19A582084308B1CD06F50B45DA1F11798C10A621307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083741, "uuid": "f4ebcdb3-d2a7-4312-87d9-dc60502cc4b3", "value": "12:t71GTvuFf8bCqjbOVJ761IHWKx6lU6IjpkYMJv:t71cWF0bBGvV2YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775083741, "uuid": "c04afd08-4194-40f1-b484-f7e5126fcd5f", "value": 632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775083741, "uuid": "89fa1786-2716-4e3f-a55b-74ae434a990a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775083741, "uuid": "9ecca231-2e44-4cd7-884f-bc61287ea926", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe8eaf8-2d98-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775026896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026896, "uuid": "9097db60-3caf-4805-a207-81798c6d6261", "comment": "Malware payload (Joker)", "value": "4a94a78ea76db8ec0a706dec7c1c9da3", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026896, "uuid": "16cdd46b-d6b4-4a78-9c13-b9b352ed76d3", "comment": "Malware payload (Joker)", "value": "faed50a8c7e21146159f37306808f5bcc9f9555f0145ca9d3e451b3bf45f7e5d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026896, "uuid": "b36f1ff1-99e7-4157-9b52-526f2d1b81f4", "comment": "Malware payload (Joker)", "value": "5e01874ce1672141591e3373a662079ecd42f871", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775026896, "uuid": "5d5e0479-ad1f-48e8-aca1-efe6fd82e72d", "comment": "Malware payload (Joker)", "value": "e957c82ef5cdf45b719b4a0fbeb4451ca23c2fd8f72c14b9d8bc1c2903536af75b0dde8d4f8d710270159e5ef7a8cdd3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026896, "uuid": "43160af7-71e2-4a32-aa1a-1cdf388b16a8", "value": "T1F5872209F70CAE2FDDF3F0385A5E12657512686DA741A7D71912D22C7EE36C88E0A7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026896, "uuid": "d955f882-31a7-48c3-b8c7-ddaaa9bcf180", "value": "786432:ELOEGtoxL+jKii6QdOCe2OPVGHb5sX2f83sRxqITf:EOEyoRFi4dne0bZQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775026896, "uuid": "17d1480f-d523-4369-9197-ec99449c85a1", "value": 38599564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775026896, "uuid": "e9958f61-8060-48a7-9334-6d3fb5cfb49e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775026896, "uuid": "2ae38567-7c3a-4338-b6dd-2bf471f0dad2", "value": "com.bulletin.ktai.cleaner_1.0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc56312d-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775054056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054056, "uuid": "bd59ca91-6fe4-420c-87f2-0421d5adf8f8", "comment": "Malware payload (SyncroRMM)", "value": "a1897a454064ea7a5c64325ddb3d7c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RConnect", "colour": "#DE9EE5", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "RemoteTool", "colour": "#092B08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054056, "uuid": "76fdfc7f-e9f9-4366-901a-a2a7572f1ae7", "comment": "Malware payload (SyncroRMM)", "value": "fb1f8d24294cafcfc7e00d4f3a90bdec6bb312b21cbbb577950fa8decc819275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RConnect", "colour": "#DE9EE5", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "RemoteTool", "colour": "#092B08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054056, "uuid": "24aac58e-26c8-44da-bfa0-01597de22092", "comment": "Malware payload (SyncroRMM)", "value": "0fdb77294152be6056ae49609180337f44651da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RConnect", "colour": "#DE9EE5", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "RemoteTool", "colour": "#092B08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775054056, "uuid": "f9bf5c96-7300-497c-ba63-a3feb19e06f9", "comment": "Malware payload (SyncroRMM)", "value": "ddae44a05f606e0e110ae13aabfd5fee625f4f2aaf740394a0d5b478085216d0c36c33ade64e2d4b3e34977bd0d411bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RConnect", "colour": "#DE9EE5", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "RemoteTool", "colour": "#092B08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054056, "uuid": "154c77ec-28a7-4380-9182-25cec3bad402", "value": "T1F9461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054056, "uuid": "d518db19-13b1-4b17-ad2c-f7c2e096384c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054056, "uuid": "18edfe3f-72f9-4d2b-bcca-88d1e7a2f63c", "value": "98304:Ah/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Ah/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775054056, "uuid": "0f8db9ac-1eb9-43eb-9262-f85acf67db04", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775054056, "uuid": "14f0510c-73a6-47ba-a446-c76cc77129ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775054056, "uuid": "afca28e5-5708-4834-a69e-6ddc63d56fa4", "value": "HoganLovells-e-Key.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1457c3f0-2dcc-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1775048996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048996, "uuid": "86bbae8b-7234-40bd-b06a-7a801db257e1", "comment": "Malware payload (Stealc)", "value": "c32b44b373852907b6c5c7ce9cf9ceed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048996, "uuid": "072bd81e-0ff0-4ebb-84da-58b40bd4da7d", "comment": "Malware payload (Stealc)", "value": "fb924e8cef93d0a4244790ba1e1a4ecaf1a93b19f8e816329cdd763b017df459", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048996, "uuid": "31a30fb2-5153-45e9-bdbe-149202686e6e", "comment": "Malware payload (Stealc)", "value": "4f417a768042a22545179175499c1e8e2334fd77", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775048996, "uuid": "047b76d9-f78c-400c-80f9-01aa82eba29e", "comment": "Malware payload (Stealc)", "value": "b3253378498babcc91d5471111238c02dba86d7481412ff92db6e7f1ded23861035d3448106ae8fc60ff41224de21e1f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048996, "uuid": "7d38f0f3-2a5b-4d54-961e-00059637d857", "value": "T1E4D4AE1275A190B7E17306348D74EB549BBDB8701F60ABCB63C0059AAE716C0AF37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048996, "uuid": "560f5273-9fd4-4e0e-baef-8bc060ffc8da", "value": "8e7a3254c76133d3b7d6e5e7e43e50f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048996, "uuid": "eed28318-1801-4829-8b52-98a9b3a8d001", "value": "12288:iUTcoRtexxNFGCRUWqL9NtiXhdyxBlDetAqxSv8UA:iU7mFlRUVfsxdybUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775048996, "uuid": "260eeb10-e068-467b-9cdc-1b9c9014b34a", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775048996, "uuid": "7d8c42e8-49d4-4f10-9a4d-48e22abad6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775048996, "uuid": "d9659462-aad5-44c2-a3e6-114211b3c7d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c96e14b-2d9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775027750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775027750, "uuid": "ee61ea6e-fa2e-4f12-8cf1-e953db32ca46", "comment": "Malware payload", "value": "47799115a617a162da0a3a8b55a9971c", "object_relation": "md5", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775027750, "uuid": "7252d479-650a-42ba-bfcc-dafde46b2427", "comment": "Malware payload", "value": "fbeb208d574f805d0a4858fb985267e6568fabc86267167ae7046cd54c4c172b", "object_relation": "sha256", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775027750, "uuid": "b02c1526-03b2-477c-bd2d-715821d573ca", "comment": "Malware payload", "value": "4f008dca8793052330b6c5ee4ad5892862f2d015", "object_relation": "sha1", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775027750, "uuid": "2c7d38a3-ffca-49c9-a8be-6b39b876658f", "comment": "Malware payload", "value": "b61cc716ff2612c2498a95b0002d93a14ff5b0f19d77992c45ea7f6c2b21efcb6974c32e4b4cb2b9fab5d610fa71adff", "object_relation": "sha3-384", "Tag": [ { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775027750, "uuid": "c7977d97-50ab-422e-8363-1b675b398ffe", "value": "T13DF573949EF16700F6D682DBA19FF584FD2E2C227058CB887ABFC49864C1D25FE48947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775027750, "uuid": "1c497408-aae9-4f0f-bbe6-fa6ac0a941fe", "value": "6144:QsmnUs7QjOvfAMsmnUs7QjOvfA7eNxnzV7Iplm0lF9q6qcqjxx7w:DmnUHOnAnmnUHOnA7CzV7Iplm0lFQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775027750, "uuid": "37879b6a-7c03-4b20-b1ec-e4385fa83b4a", "value": 3368257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775027750, "uuid": "02443bd3-a877-4a38-9145-ef32d2a745d0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775027750, "uuid": "25dab06d-1773-4711-a5c6-47fd50f7bc8b", "value": "fbeb208d574f805d0a4858fb985267e6568fabc86267167ae7046cd54c4c172b.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff3668f-2dd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775053874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053874, "uuid": "25443c86-bad0-4e08-a1f7-fabb78a252e4", "comment": "Malware payload", "value": "b19e3115c85e18cd181318878144cfc5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053874, "uuid": "7ab1b305-c040-43b2-b892-dd8f60cef38f", "comment": "Malware payload", "value": "fcc22a14e2352881109029db8aa24a0027c31a668ceb9ad7518581e0fe00dc72", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053874, "uuid": "077b017a-ffa8-4aba-ae23-6a6469208d21", "comment": "Malware payload", "value": "55adf03f84d4d0182d09ae25b12eae202cbbc299", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053874, "uuid": "f1be958e-9496-4d40-9ae5-1d5728a5ff0c", "comment": "Malware payload", "value": "457590141387a9de76f5e3ba93544f02ff7cfd10e79fbd4616382a3efbeddc8d1315f01cd64005f392af16ab4c08a6ad", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053874, "uuid": "49803069-11ff-4531-ae18-d86d89ca8190", "value": "T16F573349C8D04E4BEC7BC43A8BE4E60951A0AE257D074D27123CB34AF6F7AE472B591C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053874, "uuid": "20e624b5-c35c-4236-abfc-8eb813247495", "value": "786432:QLDMfShqLbgZWJUcePgWeJ1DaRq3HYgLgvMEs:QLqSqgZNg7Jpl3Hex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053874, "uuid": "06111c47-7083-4afb-8ca7-82291267045a", "value": 29130752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053874, "uuid": "de79f287-aae0-438b-8104-d6628a4c9912", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053874, "uuid": "62860bf5-e232-4a7e-9246-964960c167b2", "value": "Installer resident evil requiem.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0606638-2d9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775028320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028320, "uuid": "bd2cd400-8eaf-4cf8-a348-3c17ce7834dc", "comment": "Malware payload", "value": "21bb82d90bb1999322f0a8ce339c04c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028320, "uuid": "f6c2a858-40d0-4ee3-93a2-6430f8dd2c60", "comment": "Malware payload", "value": "fceab88e7ebbf3e22350818c11ec7c26afaa97eec27418cdaa193c5551ccebf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028320, "uuid": "07aa071f-6b5b-434a-81a3-c97668798f66", "comment": "Malware payload", "value": "d58f998137e27302ff6507127e73d2a596db32be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775028320, "uuid": "2497e203-a1f4-4d87-b86e-ced46c61c0c2", "comment": "Malware payload", "value": "8960d23d5f2118ba7994c1b6a9c2987687c714713afca1a1182201ae8dd46b707d0d38db853e126bbbbd105b6e68bbfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028320, "uuid": "6614a06c-68fb-47ca-bd91-e055bceb3083", "value": "T16373184573FD071FE6AF07B86920611203B5F6B0AE03EB9E1E44B1DF1816BD98942B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028320, "uuid": "999de278-e8b7-4d42-ac1a-048285ca3d59", "value": "768:GTAt3k9DQxML+cGCAqOqX4O2eRXtKdUD1GZqLagc4MwqfGl:GTA+DQaPGCxV2eaqLSIqfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775028320, "uuid": "81dad6e1-ef1b-4362-bfcc-c785d76aa0c9", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775028320, "uuid": "3854e82e-fc30-4030-9c74-1666bb8e342c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775028320, "uuid": "aa9dbb0b-7a0c-4635-86ac-3ad7fda60fa2", "value": "memorydmp (2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43ca057-2dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775053613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053613, "uuid": "189f2e6a-da39-47cf-a0c1-a3e5241096fd", "comment": "Malware payload (Mirai)", "value": "f47d7b9a75673ddafde6120ff52dc96f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053613, "uuid": "eaa29c32-801f-41a0-b0a8-e4293ddabb0d", "comment": "Malware payload (Mirai)", "value": "fe0f5e7f7cf81296ce5c7ab4347ec98fcd0553081a24030061380bbf7af867b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053613, "uuid": "45000e90-7c4b-4562-826e-207759b77c35", "comment": "Malware payload (Mirai)", "value": "bb004af42e4142ade5024fb0d2efbfa76f7e14eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775053613, "uuid": "e430c97e-335e-4e09-8f06-1d954556c0a3", "comment": "Malware payload (Mirai)", "value": "a46f49c42d518f75379c777824b8bf3162fea49d30628c78584e3384f976898b07c84b964243ae071510e94b16735952", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053613, "uuid": "656e4d3b-6185-4769-ad79-564731044930", "value": "T19F147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053613, "uuid": "74a36849-3b9c-4666-a1af-0624f2c97126", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR4UKG:IcY5JpMByVs9jSff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775053613, "uuid": "9f806c85-c907-47ad-8a79-c30bce9a48a1", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775053613, "uuid": "8d1d962b-904e-4471-82fd-51e0f48f2d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775053613, "uuid": "aedd9751-e546-4429-9277-fc99b79bc797", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ebf14e-2de1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775058204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058204, "uuid": "1659c15d-cc40-4cc0-a1d5-b130d576773a", "comment": "Malware payload (Mirai)", "value": "8ea0a6b80d0a9284844a4e15d69fd1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058204, "uuid": "02fdd64c-44b0-40ae-bda5-1474d67f7466", "comment": "Malware payload (Mirai)", "value": "fe5c3c58ed3b1baf9a82367b6b74b6d87908776135f29ecfb77c0e9e40925bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058204, "uuid": "d576bb85-3e77-47ab-94e5-bef3883453da", "comment": "Malware payload (Mirai)", "value": "92d36aecb6c8e98713a5701b4b8c27314ef0f12e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775058204, "uuid": "a5ba0740-aaf1-442c-8284-439b4b1d1037", "comment": "Malware payload (Mirai)", "value": "a31496038f12fdf61a7c97456f5b46a09889f57edb35d77696894dab0bb71ece4b0488c3c5bcc2d2a5d834512f08eb10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058204, "uuid": "7614c3df-fe53-4c49-a2e3-054a6f2f940a", "value": "T1C5A2B011308F48E1C9715872F9B9C6821BEB967843E739622AD41D7CB18190F76FB98F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058204, "uuid": "e45e8b67-29b3-4344-8a6a-edcb4d2694ee", "value": "384:TXZH4+5bxY9y9YnGNePdZEzzV3uBYIw5av5hymdGUop5hO:rZH4+5UnG6yXV3uI5ahs3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775058204, "uuid": "00628b09-14eb-4125-a970-5ea2454051e8", "value": 21360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775058204, "uuid": "eb371298-657a-446b-a548-853ff8a7923b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775058204, "uuid": "1ccc9f3a-0029-43d7-8905-9495c60ae720", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279cfef7-2d84-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775018104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018104, "uuid": "d76bb6df-36a3-4740-8e0f-c5781f073b92", "comment": "Malware payload (Formbook)", "value": "4db5e988eb7a9d1eb1816b1a258838d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018104, "uuid": "bfda8edc-2a1d-4166-bb86-05984147913f", "comment": "Malware payload (Formbook)", "value": "ff8546c70bd0c5c92117b5e453c417a85d7dd43bc170d5479ffb8d3f398ee494", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018104, "uuid": "e44adf80-8f0f-4165-a609-8f4291e6bf15", "comment": "Malware payload (Formbook)", "value": "ff11652fa5e2380a091a9069f2bbb570b0c9d8ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775018104, "uuid": "5e685f02-de34-45c6-973e-591e4866661c", "comment": "Malware payload (Formbook)", "value": "ceef0d709a2fd771659b72ce89b21860ae0ca2186c328c07cd445d8bda2f31e8fa8c55f0474edeff007f953113fcb86e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NKFZ5966PURCHASE", "colour": "#A659FC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018104, "uuid": "7fa75a76-55b5-48dd-949a-ebc2cc9dccec", "value": "T1F963E2FDAF5DC4F51433ACCB7C706AA04787D92963E06DC1E666669D89832238460CFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018104, "uuid": "c7465d37-6e86-4cc0-a315-574d20aef1b0", "value": "768:aiyExHxmoaI2E9F/f205ZH/vK6AZ4oJcp+oMNHe7vTwxstNRBhREmwoLnwa8Ev0G:OlCgy22Kfud4dDAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775018104, "uuid": "8464bee7-96bf-4699-8465-ec51743e7097", "value": 67994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775018104, "uuid": "b641e718-813a-4e47-84cc-40f3344069de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775018104, "uuid": "b49fb8b2-561a-461a-8fe6-34414e97bb41", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }