{ "Event": { "published": true, "date": "2026-02-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-24", "timestamp": 1771977781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3f065a80-2ca4-4961-9431-2442b1f1be0c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f39a6c-115e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771923477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923477, "uuid": "a89d0324-3eac-4c46-86e2-c7f131d14e77", "comment": "Malware payload", "value": "b4ee2b2a75ebafa4d5f05a51850d0b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923477, "uuid": "0928c977-6c7e-4bf1-b014-ab65cf8fdbc5", "comment": "Malware payload", "value": "00dac3d1311641a81fc71dbcf3979eefdb611215f60605ec43140fa575a09e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923477, "uuid": "196c9d09-cae4-4c31-ab8c-2cf51471c2d3", "comment": "Malware payload", "value": "07acc031510c7b8adccced8f6cf09c93cc15c8c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923477, "uuid": "f5138b65-5daf-459e-bbb8-421065fea875", "comment": "Malware payload", "value": "28bfaeb83c5682e88fc4f6eaf31273886f460b30a19903f72c6926ca5005c63f654ef51130458cab1244c8b036b5477a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923477, "uuid": "48f5abb8-b9ed-4b80-9eaf-08da75d1f4e6", "value": "T1255512586617C813C055173586F1F6B41B790EEAE812E30B6FEC6FA7BE27F668C84241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923477, "uuid": "38300a7e-4d4f-400f-9f10-a430dffe44a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923477, "uuid": "cccbdc2c-3235-4db4-8b4e-e5c09940603a", "value": "24576:pGeajyL7CEOQI4iqcDSX3au2pSVQsGJUDNgE+a/X6P:wj31tSX32p2ee5F+yX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771923477, "uuid": "80c6e974-117c-4d01-bc10-ac3490e2aeac", "value": 1408512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771923477, "uuid": "3a6f94b9-7fd0-49fc-bb1e-b2cb47a3d2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923477, "uuid": "bd08e64e-6bd8-4321-9dfe-8f07de4dad89", "value": "SecuriteInfo.com.Win32.MalwareX-gen.55185673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0075166e-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771952291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952291, "uuid": "67812b1e-7f62-4122-908a-3b192b2fce8d", "comment": "Malware payload", "value": "cfca438a704d3bfee12f5f68003b87ca", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952291, "uuid": "e4ff5c09-9eae-407e-a0b8-e5cd4b14c1c6", "comment": "Malware payload", "value": "019b04b7fd04652ee362d667b95a41977ceeff73930af18d55974cdf745550c6", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952291, "uuid": "a79b16a4-74d5-46f2-938b-0823a38899c6", "comment": "Malware payload", "value": "6012341f6bc40fbf5c643c30e1b8317922999b2a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952291, "uuid": "815951e2-0180-4b75-b03c-34706a58d3bc", "comment": "Malware payload", "value": "612e2ae3e049b985dc75368c5c4d134e41fc8c1ead9251f39e19d897f8f5f429a30bd20107e006d8872318939e02e47c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952291, "uuid": "c34e80a6-b0d4-42d9-b4fa-f600575d1d49", "value": "T131386C6A31F4C129C4BDC07AD4534F40BB31B0A90B39D7F7218452A52F6BAC5AE3E6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952291, "uuid": "f9773876-1979-42fd-bf53-a5b78224dadf", "value": "2325e02bde2b5804332bca280197ce26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952291, "uuid": "91ca35f2-bdf7-48e9-bff8-d006b0c69904", "value": "786432:ElAP8PVEuJGTp4cBqnUuFPTRAhsHS4hN:El68PVEKGTiJnUuFPd6gJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952291, "uuid": "2a6acf51-45dd-44f2-bacb-692e014ef5d9", "value": 104171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952291, "uuid": "3815a1cc-3821-4a5e-928a-a8c38b72ff43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952291, "uuid": "485022ac-7b69-4ae1-bbac-7f7fde1a28e7", "value": "DocConverter64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89077889-1114-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771891532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891532, "uuid": "1933f3c0-b9b5-4ff0-b5bf-8cfaf4ff84bb", "comment": "Malware payload (SnakeKeylogger)", "value": "f014f6e7962afbaefa12f5e788ab096e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891532, "uuid": "d9482312-417e-42ef-b84e-6651ba50fefd", "comment": "Malware payload (SnakeKeylogger)", "value": "01a27a921e622a056724c891adc41dd471c24a38ee6535cbb87f16fa3b1b5e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891532, "uuid": "86d1836c-6e0f-421f-ae3b-293a2fa2c922", "comment": "Malware payload (SnakeKeylogger)", "value": "b417a57a72acab382c303422796621178bee4071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891532, "uuid": "d9994c43-cda0-4936-ba5d-392932fb4550", "comment": "Malware payload (SnakeKeylogger)", "value": "d605b82b812e1d50728b9edc7fc90d532c7d86542697d1f4e2f5614da8d09bbbd33facbcdc9322ec422ef95bdd69e626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891532, "uuid": "2d915907-3fe9-46ec-abf9-a3096bb0195b", "value": "T18235AE027381D066FFAB91334F5AF6115BBC79260123AA1F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891532, "uuid": "409d3b90-e30d-4ec4-bfd8-9b9f7c520a70", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891532, "uuid": "dcf767dc-a5f8-4b23-9fa2-aa2948085544", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1MAXDzbpYSMSbsvOB8YsHsu/G+:yPVt/LZeJbInGizbpZBbdB3Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771891532, "uuid": "c2f776f4-7047-4970-9e18-196477d986d3", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771891532, "uuid": "3792e221-31b8-4e0d-ad86-5d0db47d864b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891532, "uuid": "873bf317-73ff-474f-a3ea-ad4661eb3925", "value": "rnewinquiries2_506_000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cdc977-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903851, "uuid": "0ff56772-ad14-4fbe-974f-02aaef33d4cb", "comment": "Malware payload (SalatStealer)", "value": "263687d0aab2df2c72a543d6d3b5146d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903851, "uuid": "d1cd4f24-3d13-4a47-b636-d4625400299c", "comment": "Malware payload (SalatStealer)", "value": "021182dd5efed1d20d1a251fe56efe2067c15013aea05e472b8ffb91f66618e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903851, "uuid": "0aff6ef4-398f-4d5c-87e2-0cf00be38672", "comment": "Malware payload (SalatStealer)", "value": "c4ebbfaa22ff74db382e86e1e4131b0abc82d271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903851, "uuid": "69340d32-4deb-47d4-966f-1b4df3fb865a", "comment": "Malware payload (SalatStealer)", "value": "dc39cbaf0d3b4133abcb48f127a829c046a239218598350166ede2c67fea54bf94a7f564c132f59da2b2eb5cba561f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903851, "uuid": "b2abbaa5-442d-4a0f-ae8e-dbc8093580e2", "value": "T193E53371B54B4599D196AC31208E3CFB6B80A74037E0F8DB4E6B13BB8067CE191F6B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903851, "uuid": "b7e9084b-4219-4b8d-a87a-44301bf3f39f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903851, "uuid": "0c45e907-7882-4f4c-86f1-9da6d7e457f0", "value": "98304:aGRrVVgKAMRMTcM/b2mRM/EZAqt8PShi:a0x+XcM/b2mRa28qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903851, "uuid": "66bd5352-b810-49da-bde1-94b5a8894760", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903851, "uuid": "445976c0-0383-47da-b288-a146db5f838d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903851, "uuid": "926facf3-485a-46d8-9458-591fd3d8fd50", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a806479-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896608, "uuid": "1adc83fd-cfe6-4c6c-b072-a4c9b4203db4", "comment": "Malware payload (Mirai)", "value": "3f852f794ca7479bbfd1d2783ed2592f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896608, "uuid": "ee8c1747-ab69-4346-a3a2-59be85c2577c", "comment": "Malware payload (Mirai)", "value": "025b291ae86bc5867928a71e1ec2043d308248bccca75283524d55ccd51db63b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896608, "uuid": "a556d11e-3d8d-4abf-b7de-679b5583cdfa", "comment": "Malware payload (Mirai)", "value": "6846c6fce03cf3d87149c43b9cbaa818fa130e02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896608, "uuid": "012b7d68-3276-47cb-a7f4-52f98f95f41f", "comment": "Malware payload (Mirai)", "value": "de9f36604a72ce75cc7ee82e900c7db8b87406bfb5305b2fa3ee07e0fdb5fffcbc78fa393ff2d25ddc85c1b6541d7cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896608, "uuid": "393ccaf6-4520-4d83-b960-bd0d296c8742", "value": "T16463AD23C9265DA8E44954F071A08F7493A3E919D0AB6FFB056AC679C043EDCF90A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896608, "uuid": "0f23008e-0f97-43d9-ba2d-5b830d17855f", "value": "1536:Sm2lxWrjSEOp2xSH9fDIo0sKW4sDW3p1eCe1QQ2:SHlxntp1HNDF0zWQ3p4R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896608, "uuid": "8480a131-3366-4c86-a176-e031292188d7", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896608, "uuid": "0776cc7c-ea78-48c1-8dc8-6fd0f40442eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896608, "uuid": "c9b91528-9733-4a63-967b-bf41fbdc9a6f", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ead879-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919385, "uuid": "e2cbf011-fe6f-4f40-a0f7-22d418cfec9c", "comment": "Malware payload", "value": "b0cddb86e7dea3bd8f63f3ced5dcad62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919385, "uuid": "f19eebab-1a01-465b-9c71-32438a387e10", "comment": "Malware payload", "value": "02f740335d95030bd66598e9966069ef5c9f15872b303aeb031e5ef228dfdf6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919385, "uuid": "9fac8b43-4a0d-4ba3-90b5-33caff0f9924", "comment": "Malware payload", "value": "f9470f41560a7c94e4bd4edd4d454ddc3e76baec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919385, "uuid": "1e427c21-88e9-47ac-99e3-532fdf6218ef", "comment": "Malware payload", "value": "d47edd5bbfcb90b137792d593153981e9a1ebd296fcccd876192bcb8d8a813a9626c52a6433f8d54092f312146eafe07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919385, "uuid": "5ae6fea8-1a6c-4b8b-8163-f0e99060255c", "value": "T142D3FA3C8F02CF982D996B9B6F74CB98580A843C5F1169DDEB3EC2464DDFE95904B212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919385, "uuid": "b09b3a55-df3a-44c1-84ea-b497df0b7a59", "value": "768:C8m/Z6sZjWsYuSwnckNuRKLpYAOpFuVxeLScFYHXwz04mYF6F2r:CPXZ6uSEYupiF84YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919385, "uuid": "32c093a3-3949-412a-a289-b7afe8c59e7b", "value": 137056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919385, "uuid": "c8635939-3739-4e71-b12b-8b78f2ea4365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919385, "uuid": "546eddca-c876-4534-9ad3-1a629eb31d6e", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36045c5c-116d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771929618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929618, "uuid": "a4cd5d9d-64e2-4ce5-be4c-929021a7d3f8", "comment": "Malware payload (njrat)", "value": "09575b55813a21ae8dd8b05ba16a7042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929618, "uuid": "8a4accdd-b090-4f2a-9f96-c292f3b54421", "comment": "Malware payload (njrat)", "value": "039da7db86cb6be73b7b1a06d64540f0b74cd1ac8ddc12af79b07da1ca189102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929618, "uuid": "3efce529-a1ed-4aaa-964f-829eb8868011", "comment": "Malware payload (njrat)", "value": "4db5f5a4d3a58a7847d1b42a915df5149fc7b937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929618, "uuid": "08cdd229-8a89-466c-9d82-613e9848467b", "comment": "Malware payload (njrat)", "value": "5b0615bf5167a94b6b99339bc816de76464113e5fb0e4b5816a29790cba51f74231667fa847132ddc5adb319700ca050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929618, "uuid": "712a0dee-0211-432e-94b8-b6e1fa7ac79e", "value": "T1AE633A4877958A15D2BD2E7844F296518730F60B6D03F72E48D160EAA7B3FC84A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929618, "uuid": "7ee2eccf-fe8d-4924-8e45-717b4a5b4967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929618, "uuid": "fa445820-d4b0-4ec8-9a89-7b6403f56fa0", "value": "1536:PRceORoN36tLQviFw14qcfTBnvbvpfLteF3nLrB9z3nGaF9btS9vM:PWeORoN36tLQviFC+rBnrpfWl9z2aF9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929618, "uuid": "3534a8bc-d783-4860-9591-eb52fac01e1b", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929618, "uuid": "c62e9603-ea9d-4a18-9001-2ed8eb397e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929618, "uuid": "c3f9b708-5f80-4946-a1db-76145379464c", "value": "09575b55813a21ae8dd8b05ba16a7042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2069a259-11cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771969954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969954, "uuid": "1ff328e2-a93d-4251-9c7c-f91e5a1cc0d3", "comment": "Malware payload", "value": "44a4b0a785520cb39c92c025184ee616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969954, "uuid": "4b68e973-23df-48c2-b4ee-502d78dc5183", "comment": "Malware payload", "value": "03dbc96e7e103f949d60bf0c397a24882ee891b1a45b795e432cc3a6eea5586d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969954, "uuid": "2ca52fd1-1f64-4286-b0e1-e605021f15dd", "comment": "Malware payload", "value": "9855999fc8d9b66ee387b88ab4bd0ac6e6605fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969954, "uuid": "6d828c65-382d-427c-8256-09f0bbd35c8e", "comment": "Malware payload", "value": "9d7581484210f6f5962160bc87da2a18cb41071f39676329a3477cc95e5bb970bfde269b55b8ec87927071604f3f4318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969954, "uuid": "10df3021-cb1b-43ad-9000-5bd5950c1592", "value": "T171953A106AC48892F27592BB000B385EA06D7E3751D78DC77AFC77E5C77C648A3463AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969954, "uuid": "d2333f6d-9382-481d-83e3-df7cc287e588", "value": "fd50eec0f7355d6f3cdb98eb5d053c57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969954, "uuid": "8dcc87da-799a-4a53-a244-bd5af8976da4", "value": "49152:GOEiLj+kCZufc2lmjQXF9f3wsuss6vtryGQgQSn7V4EawZWMqTufD:G/aj+kCZuZlepw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771969954, "uuid": "da25906a-7b57-4778-9da2-7fc93e6ba30d", "value": 2026862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771969954, "uuid": "63857fbd-32f0-4050-929d-a27e6e99ff97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969954, "uuid": "ee81e85d-e6b6-40f1-85b0-3eaa0247d291", "value": "x03dbc96e7e103f949d60bf0c397a24882ee891b1a45b795e432cc3a6eea5586d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b12e7c-117d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771936670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936670, "uuid": "847cc898-5c20-4499-8429-4ec7eb244f14", "comment": "Malware payload (AsyncRAT)", "value": "d67b22e27d9a5d8b0ba9d44a2db5f900", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936670, "uuid": "fc752840-2878-4b53-a064-bd304e50cce7", "comment": "Malware payload (AsyncRAT)", "value": "0475ec660cf828c1a13e75297f4a4a28b4f2c5fcc422de6888310c8ce52181cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936670, "uuid": "594d3ce5-3aab-48d8-bb3d-a6bb564e6c3c", "comment": "Malware payload (AsyncRAT)", "value": "79f494fc093898c5d132334b2fd5cec6488ebf66", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936670, "uuid": "a78dfcb1-b679-4b61-b356-f92d2f93b2cf", "comment": "Malware payload (AsyncRAT)", "value": "0154233deb299db6a59cbcf54ad2396c129cba05f7caa0b3bed4dd789adacb89b639e845cf0ebade5ed1db1378427aab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936670, "uuid": "b6a32e83-297f-4b5f-8b9c-e7e19797e0b8", "value": "T1CC5512273DC9939D4F08BD28849E3D26AE9D6C2D67B23EADC844A86FD731610D17C42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936670, "uuid": "deb5d646-1f36-454a-a3f2-8177a54b38ec", "value": "192:FhGiatqhq2+tDdQ1LU5nq2OS+jjbrY/1u9t+5ElSo2azqiyoIIwaAwG4HARlTq3C:AFdQ1Q5nq2OXbKDz/Ph0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771936670, "uuid": "1fbb19ea-923d-4c35-94ea-4fe801523f02", "value": 1308931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771936670, "uuid": "c36ed984-cbe2-4c1b-9cbf-c2074326d811", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936670, "uuid": "528d001a-eb05-4af7-9ae0-9a84f8695dcf", "value": "IMAGEN_209143.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fce2f1-1192-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771945646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945646, "uuid": "53586bce-1ab4-46e6-b273-6c0180ea0c2d", "comment": "Malware payload", "value": "9c126829e7998a05487f3f411900777f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945646, "uuid": "1f770b04-ca2f-4aa5-8ba7-10b65b61bb99", "comment": "Malware payload", "value": "04a33e6ac3ce8f8e832d51a452ef935f19cb3e16e8f41375945e7092b211c335", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945646, "uuid": "adbb9e5d-2023-4ec7-a9c1-d20cbf370b1a", "comment": "Malware payload", "value": "58294cfeb16f34ded558c9d08059318885a8c3b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945646, "uuid": "bcb1059d-c34c-4dc2-9a36-3eea8c0111f6", "comment": "Malware payload", "value": "5b3e94114badf287bb2aeedca0dd9408ecf47189d144a76bcea602893c30be74c2725bacd4b03a16ed2dc0313dbd4c8c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945646, "uuid": "241210df-b29b-4be2-8c1b-07b070c7a709", "value": "T1646612A8F62021847D915818807F7E97CE3BC152E092CEBF6E6876DBE79BCC75590C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945646, "uuid": "38d8966b-0b5c-4ca9-a3ff-48ec9e3eb7f0", "value": "192:+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaj:PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771945646, "uuid": "ebb1a90f-1cb0-46ad-bac8-75ddb86a15a2", "value": 6636767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771945646, "uuid": "0ebe7e55-d892-472a-b639-05de681f4939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945646, "uuid": "1c5c43c8-4e22-49d8-8e7b-a2681929db6b", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6704cde-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919552, "uuid": "c30688e0-b17a-4385-83bd-2296f5da450e", "comment": "Malware payload", "value": "66fea86b5854b4f457c8f0257b994935", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919552, "uuid": "67bb2441-17c8-4e08-8acc-d04358ab2caa", "comment": "Malware payload", "value": "04fae04480ebef8db3d4cfed8c355dba73fa2ab6ef3b1b2ac5df7ee659a83705", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919552, "uuid": "5df6dad0-1b08-4015-bf94-343f5bbc2dbe", "comment": "Malware payload", "value": "5738c6b74834f82a2c1195f09eb26676cb3c9b15", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919552, "uuid": "95a56069-702a-4725-bcd0-379cf5476d70", "comment": "Malware payload", "value": "e177f4477c6099faf1165c2f2bb893be81d1f40ef9c237e91fa86d0085372c853731016cfad23fcb7ff296ee946df148", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919552, "uuid": "4aff52b1-3e6a-49a8-b80a-7e447ef298b7", "value": "T187D31AE762B1DDDE43A481ECFED3100DDE1BCB0C6422E1F697EF964617A2949CB59820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919552, "uuid": "ecd3e0bb-f87c-4697-8039-b60ff2f74a26", "value": "1536:CPXZ6uSEYRBahRb9X7bNEXJRxBf/iV1ieSFh9SFt4VjXu49FTplqtWvR0NqXJRxI:CPXZ7YdZph4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919552, "uuid": "00832586-fb1b-4767-b7a5-1aea92c83dbe", "value": 137016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919552, "uuid": "b0573882-5a7e-4980-8e33-a938b27f2782", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919552, "uuid": "67a6b0cf-3121-46f2-b8fa-ef28ee259951", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b20e4e-11b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771961854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961854, "uuid": "942d653a-7f44-40fb-9972-2285aff8a434", "comment": "Malware payload", "value": "37c37351e8ca12f977a6f922da49b6bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961854, "uuid": "f2146ac6-4777-41bb-a9da-1717180eae78", "comment": "Malware payload", "value": "059073cc6715f5db99f80ce55a2d8b5ead2d22e23a33122e358b3e88f66d7fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961854, "uuid": "af797544-fc8a-4f80-a06a-b353b9135288", "comment": "Malware payload", "value": "9bc53c0c6071e7ad93712197393e5798d39ec6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961854, "uuid": "1ecdc23b-4df8-40fa-9531-608e80003899", "comment": "Malware payload", "value": "d4206b538130fdc2b62a4e62fbec2305b3579138b4871c89fd8433953b561c31fd9018eb68fdb6641629ddebd6808171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961854, "uuid": "400c4e46-9da7-4ae5-bf2f-20bfcfddbc8b", "value": "T14B07183AF4600E3AC4DE2A7E548B03519732514F4BA79F8643D8B5397F4E3A02DB578A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961854, "uuid": "832d7ce3-1a6e-481e-bed7-0519e288af31", "value": "841df9baf321574d4449d661fcc4a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961854, "uuid": "b1986d1e-1d6c-4d7b-ad6f-eca5982d1b49", "value": "98304:4paOTEikjpnQ1Ow/V0vkFVuvRHyqP4wPAwY:4p9IVNR3wwPAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961854, "uuid": "888c0004-e7b1-43f1-b648-7a22ff51eef3", "value": 17355451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961854, "uuid": "62eaa139-ef38-495f-a88d-6eebccd3a3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961854, "uuid": "ea154186-ece8-4384-b287-afaf6e05b1d4", "value": "S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac7b858-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919506, "uuid": "fafa4561-d341-44fd-82de-d32f2a8ff268", "comment": "Malware payload", "value": "e6780d0f475141226e9e35b342acdd7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919506, "uuid": "ebebd413-6240-41df-a299-afc356333582", "comment": "Malware payload", "value": "059d98c23091f578896420a64d530424ee4a65ff4ee9136b27bc5ed46c7ced3d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919506, "uuid": "4f885b94-9649-4c2f-a8c1-c241095fcc9d", "comment": "Malware payload", "value": "cd5ae9fc291aafd55b169441742e403321b16b5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919506, "uuid": "aa658705-b565-4775-bad9-873acd1d1470", "comment": "Malware payload", "value": "5c2894143abf9cd194dbf151a0f976f4fb506c8f0ce22d7cbc4411034e1d7c1cefb071e221cf9c47071b2e3c7c7ad2ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919506, "uuid": "3df63ab5-b92f-4e46-9df8-ef28257d375b", "value": "T111D3F9817C5D1A9F0129383DED1359E8C89FCC9C0A666DA724361837307FD87ADBD8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919506, "uuid": "a38cd5c7-4220-42b7-b3d5-2e0117e64d37", "value": "768:C8m/Z6sZjWsYuSwnckNuRQpHFLtmsmTNhCbTNHIJ+lS6xeLScFYHXwz04mYF6F2r:CPXZ6uSEYQpHFs24YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919506, "uuid": "1f3d34d1-2066-42fd-9060-b6a57c887727", "value": 139903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919506, "uuid": "2abc226d-c535-468a-9b50-7422bf4046e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919506, "uuid": "eb335eda-dbde-4054-a48b-57acf335dbcb", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d989c0-11c7-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1771968601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968601, "uuid": "8cb9f2b5-5220-4340-a2be-36ef422c3f16", "comment": "Malware payload (SyncroRMM)", "value": "6c2cd03d36458a3b59f2a9a7d45602fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968601, "uuid": "05cba043-1b45-4a7f-b70c-48f8478679c6", "comment": "Malware payload (SyncroRMM)", "value": "06431dede3bc353da8da322364c87c973ad132d0e921356af5f677e91b05fa7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968601, "uuid": "f1ba4bf4-8bf2-4f0a-816c-648cae559ad3", "comment": "Malware payload (SyncroRMM)", "value": "fed5bf1afe75547971a7552106dea5370890ee57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968601, "uuid": "918c8719-c941-4a4f-a6b4-46e21653eef0", "comment": "Malware payload (SyncroRMM)", "value": "3165163e55075ba6c49832569324c9f2eef2735ed864acbe64d7c7d687a032d00dd53caae650d60fe09eadb8c54655f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968601, "uuid": "2ca22674-3f2a-4395-b0a9-8a2d8cfa12a8", "value": "T158461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968601, "uuid": "31331177-c84f-4afb-ae05-4428f8f4f429", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968601, "uuid": "b6c979ef-5abf-48d5-bdc9-7bebd26878b4", "value": "98304:Ih/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Ih/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771968601, "uuid": "5760849f-3029-4a20-a283-c5eccb99f34f", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771968601, "uuid": "37a21bc2-e6a5-41e0-a9ff-3f8ccf237766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968601, "uuid": "06d02dd4-eb72-4543-aca4-9b9e4939fe5e", "value": "AdobeFile7837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f558968-111e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771895837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895837, "uuid": "8dcfafa4-87ee-4871-bf36-f31197b4c6bf", "comment": "Malware payload (Mirai)", "value": "69f557366270e931a137c68f55ffa96b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895837, "uuid": "717d0fb3-750d-4540-869d-cfa056c01af6", "comment": "Malware payload (Mirai)", "value": "067ce85504cc837fbb2c523bb69be9684f4a321aad5d2172175a8a9b9230a866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895837, "uuid": "ff2b4637-9d1b-47b1-93f5-ee5f6a094b7e", "comment": "Malware payload (Mirai)", "value": "3fbfbc813319a2bb36053fba182d060d0c212e62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895837, "uuid": "4d0fedaa-bd3c-4b14-a395-8c94b9c668c5", "comment": "Malware payload (Mirai)", "value": "41438f033fbf2fd620c6f36bab0226736dc20a9bdc000e465184d2f968c6542ff5a9895871102b392664e3de64a1ad2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895837, "uuid": "9ca31ff9-bc7a-4b93-9037-f194d61765db", "value": "T148933A02B3180A53D0A70DF03A3F5BD187BEA6D121F4F689652E9B859671D332586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895837, "uuid": "9f25f255-95f6-4e6a-88c2-e2dd2a5535a0", "value": "1536:69f9bDWB5W3Ttxr+PBBaY/m2AdUZCD/nHTIUYGRKLnqj80vrAC2a8n+o4yR7eo8P:atDWSTKBV/HZQIOIsh8C2anoXiOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771895837, "uuid": "5e4a235b-d4d8-4393-9789-2d44fd1e8282", "value": 92960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771895837, "uuid": "e3d8d4f3-2027-4006-9012-1046a19450d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895837, "uuid": "6595d2d9-0167-47f7-8c35-a09e43425df5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3f4dd1-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917441, "uuid": "6367b138-bd66-4cc9-bda5-737ed583817c", "comment": "Malware payload", "value": "5bec5f074203f3b4905da4db90f04c93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917441, "uuid": "0882fe64-7066-49d1-997e-4d56b1642cc9", "comment": "Malware payload", "value": "079f36ec71c3add9611c86dec9d170123a1f1f94c69502d05eb9d71f83c25f10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917441, "uuid": "65ae8f6d-be76-4c18-8c79-807383e1c850", "comment": "Malware payload", "value": "533b89ff2defd47216ee3f82db1fc9f3f7955664", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917441, "uuid": "47228aa6-958a-4d10-ac8b-8f97e1ee60a9", "comment": "Malware payload", "value": "949045bcab8c9a5534755c763e4e6b41c80d87fb14777457e54787375d9799eb7e7f9f13831f124233eede0ffffbdfa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917441, "uuid": "90f9db79-7a31-437e-b51a-4f3760e0dc3a", "value": "T14BD3D8DA9FC6E2C977CB616C33158F7E6E56F1D976A420438DB483D90043B25D3A0EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917441, "uuid": "cb87b41f-eb29-4a0b-8958-69ecda660279", "value": "768:C8m/Z6sZjWsYuSwnckNuR7poCBfsXK0FerxeLScFYHXwz04mYF6F2r:CPXZ6uSEY7pwFS4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917441, "uuid": "59995186-1d23-4e88-9a9c-733ad51ce65e", "value": 139980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917441, "uuid": "5bb29b36-bf3b-4575-bcbf-3497c0f90f08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917441, "uuid": "1b30cbd4-7faa-45d7-a953-af1426b979aa", "value": "invoice-1645080830.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370424f3-118d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771943363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943363, "uuid": "76046cce-420d-4b13-a695-bab2cdaaf4e0", "comment": "Malware payload", "value": "2a152a844adc39b730769fe0ec498f4f", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943363, "uuid": "5b10a2ca-d43f-4431-af5f-e993dc0e3f65", "comment": "Malware payload", "value": "084239ba4742045424ecd68e60a1bef04d1e9f2d61ff10ff703026c4bb7e121c", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943363, "uuid": "ba69984c-0a90-4c38-a720-e5db4b0614ae", "comment": "Malware payload", "value": "0fc6ce0aa9204ae812c632972b8925d1eb9fd926", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943363, "uuid": "8156119d-8d3b-4bb1-9d73-9846d8e4cac8", "comment": "Malware payload", "value": "422e95cf2df62dada6ca48d1d8eb2572af2a94eaf225d33f43fd204301c4ecf9768d2e78a71a1367774ff4019b8afe20", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943363, "uuid": "f06794d3-58bc-497d-b1c7-b749726c8929", "value": "T10D28333379DD8B32E56F88349AA4DA3E52F13DD007B145DFC3E49C2B09266C245B9A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943363, "uuid": "9a41c961-a7ae-492c-a550-11edee9ea5d5", "value": "1572864:Iu24gwS8N/MScQm38g5LPZA0W257RvU7UPcs4QfDqQyHxIbBI4oCSKmDYYPb8sQS:I49S8N/M/xLP4aO7S9ffU0SxHsH1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943363, "uuid": "8b56da10-f365-4c80-961a-f946d6d51088", "value": 100397568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943363, "uuid": "9612176d-6845-4aa6-becc-8c4ef18f7ea1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943363, "uuid": "4bb06bd5-e230-4b35-9993-320fac978d2d", "value": "googlechrome64\u4f4d.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8f45b8-116d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1771929657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929657, "uuid": "469df066-b2c4-4e50-956b-dc56f34d381e", "comment": "Malware payload (Stealc)", "value": "759650117d89f3e6ab4ccb5ef400d160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929657, "uuid": "83f01aaa-dddb-4e25-aa78-618c5fb5919e", "comment": "Malware payload (Stealc)", "value": "08b627c83ce0b3cffa836adefb5cf3a5210aa2283e5487b195510ec1fc91f506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929657, "uuid": "47368ace-e243-4087-b742-6e2bcbdc04ef", "comment": "Malware payload (Stealc)", "value": "d895e86eba3acd5d89678706df0a042feda725d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929657, "uuid": "3977b321-9f99-4db3-95fb-3769a8aeec20", "comment": "Malware payload (Stealc)", "value": "c20bb97ed202bbcd62438b97420ef3cd7b3b88d4ae0a4ee68111b0ed5c8b708f2446d0252425b7bb20125318302b8b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929657, "uuid": "f8aafb7e-3d16-4de7-bc97-656d483e24c6", "value": "T14AF48D1FF3E501F8C4BB8178C9665956E77A74561330A68F03E01AA63F2B6509F7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929657, "uuid": "046abdfd-0a3d-48cf-af40-01f63bf4ef74", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929657, "uuid": "67f279ad-1993-4d8d-b017-ea28ad983b51", "value": "12288:gwVOm41h6aMIChNqge8bNqDVqlPjzad0HXiWv3YZtF15kjHx:g2eMBThN9eiyVqlPjzU03b3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929657, "uuid": "b27bb526-35e6-4cf6-a77c-664bd0ace18c", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929657, "uuid": "32693463-51cf-4155-890b-406c6a1081a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929657, "uuid": "76a57afa-8b53-462e-a729-639ff7e58e94", "value": "08b627c83ce0b3cffa836adefb5cf3a5210aa2283e548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d0c2ee-111f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896063, "uuid": "d6163d2a-da68-44df-9b50-f92abec1ae7d", "comment": "Malware payload (Mirai)", "value": "921ad58dc1f53b9333236a5b05b3bf30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896063, "uuid": "125ea58c-83de-4394-a107-424234aa730e", "comment": "Malware payload (Mirai)", "value": "09248c92e950ad3fe944df1693cbe412fd5731ca046e2482435c4676a4ff87a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896063, "uuid": "8ed8d80b-8f04-40f6-8b8a-3d413e9f557f", "comment": "Malware payload (Mirai)", "value": "dfbd2ac90c4a4b938c76b65591978705e130cbd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896063, "uuid": "eb73870e-ad66-49ba-90dd-31c81c515cb9", "comment": "Malware payload (Mirai)", "value": "346d25ad179566125b568d5ac122506309bfc8b45cbdeaa64e9b1b74c049613d2cbb89cb37471b68ef5c5572617dbf25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896063, "uuid": "5eb458d9-52fb-4ea5-9067-1aef5a11195e", "value": "T187564B19FB8789E6F3A355F0134AD273693050199073B6F2EF8D3B65743A2416F2A22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896063, "uuid": "72df18db-c870-4c24-93ec-89d48483f94d", "value": "98304:D+BUNppnuC3XZOxVKVtG3K+Qy8EExfy+M0:a6NpREwySxy+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896063, "uuid": "cb8ef4ee-fcb2-40c4-9a0a-c2bd5430b7c7", "value": 5907480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896063, "uuid": "88b56690-af53-49c4-80af-9bf9007b3ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896063, "uuid": "2d5f4d49-4a42-4521-b8e5-fc604bfe5c6e", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c111301-114f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916662, "uuid": "8e0ab03b-9761-4bde-af87-ac917d677427", "comment": "Malware payload", "value": "2e3c965994e8139a4419a7aa7445924f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916662, "uuid": "02d6f423-979f-40be-a70f-640e9b6693f8", "comment": "Malware payload", "value": "0979648739595d4a7f9caae2f9afbb28359b4521b2229201af01a807d757523f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916662, "uuid": "bb0c6cdf-ed7a-470d-83f5-f9caf7d26807", "comment": "Malware payload", "value": "d86b77a9bc73c8c4b1d4de810fe8b5bf72ca9936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916662, "uuid": "0f03328c-756d-436e-9cb0-1b0dba6c3ce9", "comment": "Malware payload", "value": "ba486d395ebbea10dde28ea8816e2346de062fa796dceba551fa7f7a0a449d1db1d455df94d99f8f2a4b27ce7100f78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916662, "uuid": "136e59d5-51f7-4ddc-9036-f7387121315c", "value": "T1B373F803E2E410FCE1D8C278939B9A37DD31B8C9553469AE27443A122BF7E507B1E675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916662, "uuid": "e0ffba28-9516-4b3d-ae32-b9db2349e60f", "value": "1536:Kj0dU4VjTQTUdvRwbkGrY7WM92yjqtFlwHXoY:Q0dUGQTUdvR8LY7WwqtbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916662, "uuid": "df1ac745-b0fe-4877-bb2f-6efd2031bd1e", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916662, "uuid": "9a2ea86d-3fb9-4460-8ad6-4f1cdca28cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916662, "uuid": "42c12d0c-c3eb-4c91-8e1d-c71fd9e6f338", "value": "img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daddba3-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771957038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957038, "uuid": "10e45828-ec4d-4dab-be6c-86973642a81f", "comment": "Malware payload (njrat)", "value": "7d79a2b5fd4b3193e12efa1016f56e3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957038, "uuid": "f61d418a-6cf9-4b41-901d-d073743cf087", "comment": "Malware payload (njrat)", "value": "0990e0c4c254fb770ac7aae18d865b157be9923fc7ed0cee2dac31cbf511676c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957038, "uuid": "53e1c219-b6d6-48e0-be40-cbfdfde241d2", "comment": "Malware payload (njrat)", "value": "52073aca3f85d1acf131ade3b486db1d28e0289e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957038, "uuid": "5a002959-002e-4633-b53e-a7129230b179", "comment": "Malware payload (njrat)", "value": "a59cfdd8f5f72c0ef896e4bbebd4a7468b6c6ead5083afc1700db7a9ba4fcc3c7e6fac06e2be300bb8dcfb6e18bd4f24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957038, "uuid": "a5339005-0247-4acb-a4b0-892a642f1588", "value": "T164D4AF04BEA13DB5CB7B994654FC338EB7986FB76185487EE502E48166FB3006B47838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957038, "uuid": "aa26e3b7-988c-4be7-bb71-2209591400b0", "value": "6144:jFgsp6BRe6niwasBYZCLtc7uR133hufMsoDbZajaj8W9w74:jFgpBo6lhBGQ362Db4jw8J74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957038, "uuid": "07134fc5-3d3b-473b-a0e5-d71e8392786d", "value": 647796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957038, "uuid": "fda7ae68-bc10-4dd3-9e48-5cd0704da7c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957038, "uuid": "14912aa5-1fb9-4806-ae5f-f52b5a580983", "value": "PO-56789876.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5f029a-114a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771914569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914569, "uuid": "8a6d0445-09e8-41b8-8a27-6ada644e43de", "comment": "Malware payload (ConnectWise)", "value": "bdd0010ba8d2d219798e628f97d7f0c8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914569, "uuid": "b4616ba9-6d5f-4000-8138-ca353df5a2d4", "comment": "Malware payload (ConnectWise)", "value": "09ca5174e95b6a55512a4e4e49759ff58dcf4d460828871c370b8f4124eba754", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914569, "uuid": "a6984cf7-7822-4237-8d73-0aeab789206a", "comment": "Malware payload (ConnectWise)", "value": "c076c9dfdfac16601c574e6b2f475ad9b4c30abb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914569, "uuid": "d2e1fccf-df6c-4e28-944f-40d8583f1d44", "comment": "Malware payload (ConnectWise)", "value": "9f8a59e927ba3e59f0d3f2e4252a875631fc9144e58330d726fa3c2a7218ca413f226419a39732af2f4497de697e0b95", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914569, "uuid": "67cca70b-ab08-4d1c-a3ee-bddc3537ea47", "value": "T19D646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914569, "uuid": "f544dc3c-580f-4742-b218-90aa388b0dab", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914569, "uuid": "fafd71c1-1644-4a44-819c-24fc05529929", "value": "6144:VmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9f:g1iw7gryNkSV1hy1Z1u2JLu9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771914569, "uuid": "ec07d066-5bf5-4381-84b8-3337f86c76d8", "value": 312608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771914569, "uuid": "345a01ae-68b4-43c9-8163-78c06d02e3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914569, "uuid": "2f459bf7-68f9-4ade-95c4-e8d90213c2a1", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4d0d00-11b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771961335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961335, "uuid": "4554ba4a-3498-4448-9306-2d6b6e0613c4", "comment": "Malware payload (Mirai)", "value": "c978b3e47cced74a1d1497da945b8ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961335, "uuid": "ba6c4051-d366-484a-8388-4498b43e191e", "comment": "Malware payload (Mirai)", "value": "0a1974f2a8ce22fa40748271a1c9d8108dda5dfb5e755e40f12fe6c315ac7038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961335, "uuid": "f8e5ea94-e101-4652-b01d-dce726917173", "comment": "Malware payload (Mirai)", "value": "01a7ec03bb16c01ff882509329aeb699ab46b0fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961335, "uuid": "956a7b6c-c649-4e9f-a462-9e3ea2760f50", "comment": "Malware payload (Mirai)", "value": "b9dee99517d25ec0965ba7282e18b9cd2a1ee3a5317b73a2c1d77dd51bec22a478d5b254d4d1770e8e1b01398577f895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961335, "uuid": "b9f7275e-5694-4867-8198-acee84c58a77", "value": "T144C36B73D8296F68D6559030B0719E792F53A59182871FBF29B7C2B18483D8CFA05BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961335, "uuid": "6971b29f-c77e-46fc-8a97-b1fd6474e9f5", "value": "1536:j0xsFI/DD8wI1YZhUPT2gTGvjn+lxC+tKiG4sXfmH3XP7bOWbfQDzxVn+cwNAr:j0xVrDraPTdFlx70iemH33OWjQD+tAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961335, "uuid": "a98d6868-842b-442c-95be-58ece1c1f86d", "value": 129888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961335, "uuid": "149d935b-23d4-470c-8bc6-e9f3d5bb2c20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961335, "uuid": "4433f5eb-b679-4d7e-847e-bc8863bb8298", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d9c406-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919410, "uuid": "5dc96a8b-8a0f-42ca-80a6-434a0d2c2cee", "comment": "Malware payload", "value": "6fda33ac529bb5a4609eaff682ba9ce2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919410, "uuid": "336474b9-096e-4d33-a79e-e7e4a9787251", "comment": "Malware payload", "value": "0a336a33ad5f69a4df68e89c11e2cad515da5106b678b863a36632064825e81a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919410, "uuid": "ba989207-3395-43da-95eb-4491cb868dd6", "comment": "Malware payload", "value": "c7f1ad4e5f1f76147fea617e5a565a6027330760", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919410, "uuid": "e29c127c-d6d2-4ffc-89a1-34394d9237f1", "comment": "Malware payload", "value": "b30556ba2761ca81d1d2128f5471603039130412e98bce4679033cdcc3b08eaa6c9d0c3a5b075d100c3674b2c1e2f7da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919410, "uuid": "5899caa1-3bc1-47e9-a89e-7b30f163aacd", "value": "T1ABD3D7F131557A15E4C50A2F85FB62BF9EEA615FC7DBF746281B276C08DA16B00032B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919410, "uuid": "e095bb66-8d1e-4db6-a7fe-78b5035653b6", "value": "3072:CPXZ7YOZQyhU9QLEwtUtZpSCpOP1NeQNhlNgtzle29EO3Vh9T19Oht9V5VCMToGk:E/ZQyhU9QLEwtUtZpSCpOP1NeQNhlNgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919410, "uuid": "e447f812-d6f8-4fff-8403-aa9c2f2f9a39", "value": 140891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919410, "uuid": "120ae4c6-4a23-4ae2-9e61-102725ed0e11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919410, "uuid": "ea9497e9-c145-4d01-9138-bb747ae48c1b", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf88d2fe-111f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896348, "uuid": "bb7fa280-f83a-4873-a329-a35469c97cac", "comment": "Malware payload (Mirai)", "value": "f945dd0f319794aa7e26a73d404d66c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896348, "uuid": "95bb7cf3-4450-4413-a203-eba7df9dcaca", "comment": "Malware payload (Mirai)", "value": "0a9869778c7a588ee09bbd790aea05fb684a2c064fa102605ec446b4ac315b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896348, "uuid": "e9a66b3d-a02c-432a-adca-556d2f517b40", "comment": "Malware payload (Mirai)", "value": "e0e0afff226b8ec662a7f393f3b6d4a1b247fcfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896348, "uuid": "e0681820-2510-4d63-804c-f77b6ec5dfb4", "comment": "Malware payload (Mirai)", "value": "a95b0a55d1232a3a6d24ebd2295f9920e8a72e7294412411defab296c497fd6ed37290b22f134750fdf9e967d91ea735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896348, "uuid": "804d77bd-8438-4599-8c5d-7be094450a77", "value": "T1AA735C02B70C0E87D1635EF02A3F23D2D3EEA6E121F4F684651E9A46D1B5E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896348, "uuid": "83f5cf6e-257b-4702-a4c4-27d13d306a53", "value": "1536:PMzcNC+TcOrhsanbLhtGjUqR+Z9qXuVm7HWCa4UNW7:04jTTLEUqR6672COW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896348, "uuid": "b0da4516-d14a-477b-aac9-662dbc863755", "value": 79608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896348, "uuid": "168c37f1-5ce2-4acd-b036-b8fabf39a246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896348, "uuid": "1e737a9c-1bc9-41a5-9ff1-3e280250d501", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8135397b-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1771922013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922013, "uuid": "5ff7d416-033a-4e69-ad80-8560774be181", "comment": "Malware payload (GCleaner)", "value": "25bd1c592a886c4452888b6e77b4ed68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922013, "uuid": "894b1e23-bc02-4c65-be12-78d4d0f11569", "comment": "Malware payload (GCleaner)", "value": "0b619104205152fa5d574ee6228d070b89c00296beecc681ac9b5d847ce36e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922013, "uuid": "0cbffeea-48b7-4c86-b3c2-cc8b1be8c6e0", "comment": "Malware payload (GCleaner)", "value": "93c5bca0e0d9dbce7e372d18e484b697572f9aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922013, "uuid": "8da68d5f-0358-4cf3-9ae6-f4cba998b366", "comment": "Malware payload (GCleaner)", "value": "0ad3db564e673b3d1d539d007636cdd8198c7708f2a99ab1a8e578a65fee9f6959fb40de3460e196da8deeb43d618878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922013, "uuid": "a4a21432-379c-4de2-911c-0232592885c6", "value": "T1B245AF33B1925433E17216B89C2B67545829BE112F38984A3BE63DCE5F35F4279242BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922013, "uuid": "8d905993-f69d-4af1-8936-7c67d26d1bfb", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922013, "uuid": "7aef8022-8c3a-42b8-84e8-d68a231c7991", "value": "12288:pVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRMi9/7hR1J992LcHEGN:pVwXV4HSmYq7MPPfEd+epg5J3324kG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771922013, "uuid": "be90d54a-3c38-4800-97cb-6a112849f45a", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771922013, "uuid": "0b7d2288-d3c6-4692-b9e0-f976a390469b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922013, "uuid": "036b1bce-1a3e-4dc0-9e88-4d92d0c47862", "value": "Payload (18)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff3d8b8-11b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771960397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960397, "uuid": "e811b827-acb2-40ce-9cf7-73d1a357cddf", "comment": "Malware payload (Mirai)", "value": "94ef8c7cdfc515164de0ced6e59f2c42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960397, "uuid": "a54889c4-8463-4f73-9a08-01e61be34906", "comment": "Malware payload (Mirai)", "value": "0c053145d14da86595383e84e9217d13cbe6da91a92b7950006a233c98ab52eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960397, "uuid": "255a4be8-356d-4133-b99c-dd22fe692118", "comment": "Malware payload (Mirai)", "value": "a03360fbb0b8252a3c616ec7700346465e85c976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960397, "uuid": "70bd5f82-70c0-45d5-9e8a-0ede78118730", "comment": "Malware payload (Mirai)", "value": "49a0595cda4801d098dcf0c18aac20552a737552d16141b9af3dea59a45b7a3995692610464ab90bafd31a3bdb017f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960397, "uuid": "9433250f-86bc-49b9-9212-c9f332c34b99", "value": "T1DD14A81E6E228F7DF668873547B74E259B5C23D627E1D640E2ACC2105F6028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960397, "uuid": "d6bb7fcd-7c70-42b6-9cb7-85cddf55d8e0", "value": "3072:Vw2QX6d79AL2k0klZu0IBXShxwcaa5vRBBiO7pMd7Oi:y2kAxk0kNKXixT5PBiOqd7Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960397, "uuid": "89e082fe-7206-41a4-b68d-beb74e3c83b5", "value": 191008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960397, "uuid": "a9801a66-f31d-4d8f-9e5a-943321bdcaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960397, "uuid": "ce1673ed-afdc-4f34-ba19-18750fb868ec", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff077eb5-1190-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771944987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944987, "uuid": "e740e1d9-0dd2-41ea-800e-6871b4045195", "comment": "Malware payload", "value": "309c63c708c1378da092f1872627c4c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944987, "uuid": "03976a11-91a9-4135-972b-19f47fc6f969", "comment": "Malware payload", "value": "0d0ca60de1f5d8df133af2387d3d503ecfdad02fc2daf1ad5ceb3d1124d24336", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944987, "uuid": "2525ff3d-be1c-4367-9edc-78cf7cc98899", "comment": "Malware payload", "value": "fa0ad6ba38f5a18e03116e1c65912a8177ec1df5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944987, "uuid": "65b24d07-65f6-4f66-8dc9-f46d786ac230", "comment": "Malware payload", "value": "b8b8a1a9113785871d700619ce1b7137fb45832e6bf1edfbf7d03a80232e0689f5537ee99faf9a4e51c11403004bc99b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944987, "uuid": "5dcea1cc-2b5a-46d3-bec6-a173b5596027", "value": "T1A105180673858E52D12A1332C1E70C0087F7A68A776BD71F7A86676968833DEDF06397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944987, "uuid": "39294338-5a79-4a8a-8da7-c658a587443d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944987, "uuid": "98ce236a-ceaa-4a14-bcec-77622a2f43c2", "value": "6144:Lhxz6DKlZod0d2JpqgWAiw4smnNdNIGBMv6AJlulFZ1ghKM0Xp9ZkmQE2I/23hVW:Lvftq4smnHNIAscrZkWR4hVucQOUdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771944987, "uuid": "a32245ea-aee1-4366-9a37-cad7afe155d4", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771944987, "uuid": "184f7142-34f5-41c1-b504-582cbebf357d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944987, "uuid": "9195aaf6-1b8d-4639-8d61-332e23a1f317", "value": "Osnnq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ed7317-118c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771943041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943041, "uuid": "5ede774f-6664-41b6-b35d-9538a07374e6", "comment": "Malware payload", "value": "78e5b7d1dc29bfe256f8c29fec1f555d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943041, "uuid": "32eefedd-aa42-4e02-a6ad-cf2fda4a8979", "comment": "Malware payload", "value": "0e09f12fc5fd9a2ad9b0b34e909ceedef108a1fcab87b8abcbce923b2b42f93d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943041, "uuid": "3d7cd5c1-9b33-4a7c-b20f-db4837a6a7d0", "comment": "Malware payload", "value": "88156d882a81ae6af326bd10c804ba6b2da6be86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943041, "uuid": "3f12e1c2-e48b-4189-9ee2-397af7dc981b", "comment": "Malware payload", "value": "95f1653566cc24b87c285ba6bb6617ec96ea570aad63d8756deed960003db15efdfa055cc0fc4e247cc5062ac9e9086f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943041, "uuid": "29d3052b-ec34-4690-adac-f366e56e91d1", "value": "T129E0CD48B135F7735571D3A95E82D55876F542116F163D0CC1F3049FDC52475B22CAB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943041, "uuid": "9f9a86b9-b596-410d-9fb9-d682eb638707", "value": "6:SrusxtbZxLlmWkFbJZbXLWBL2eeutJBC+n:Ou+tbf57kJnbXaAeeutDC+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943041, "uuid": "dec1f18e-5148-4f52-84fa-c1ef510e13bd", "value": 299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943041, "uuid": "53576bba-5eb9-4d1f-bfd3-4b2d80555885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943041, "uuid": "3a073118-68fb-4d17-bc8d-f8526aacb92c", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747f6e2f-1187-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771940889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940889, "uuid": "806fa607-ee11-4d98-8933-26f43d99fae2", "comment": "Malware payload", "value": "334c9a83996d2d727e5faafa4c80a9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940889, "uuid": "e750b057-6146-4b8b-9310-662e72cbb09d", "comment": "Malware payload", "value": "0e3e95ee6649238171fb409c143c8a944bc54332f0ce85b94c651b5d0bf95343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940889, "uuid": "a5b0fdca-eae5-44de-9098-91641250d643", "comment": "Malware payload", "value": "67e1fb1419eb9d012f4ae09351c6c48dc55a8216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940889, "uuid": "56476807-4f19-4c84-acba-38f21be91d1c", "comment": "Malware payload", "value": "ffcee8607806f7730a85f92eeba74d0e785493cc6091ee1a5b94fdd49de4ef43cdf2a89f7fbefef07a2adab2fcf6a0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940889, "uuid": "57e9fe74-6278-40ff-b541-ffcd0ba80398", "value": "T1AA445C5577A40CF8ECA7823DC9564A46D7B2BC260B60EBCF17A043561F236E19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940889, "uuid": "b902a1f5-40b0-47dd-a06d-63926b8a4413", "value": "bdcc417182aff23aa735853592246a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940889, "uuid": "bd811e7f-963c-45c7-a259-d319d2fc191b", "value": "3072:1uNB8BCyqJUukkmyl4BBi94KUA9KmrhukKEwEbD2+xlKroU6DDHHXA8sB0sjfmb4:1uoQ4BBi9vUA9/r8kKE93jpDDYWHeSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940889, "uuid": "4653281a-bf24-4564-a5ff-c14cd64454b3", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940889, "uuid": "395597de-7a36-4e84-9586-e7f5636b5aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940889, "uuid": "f8a0694a-6fd6-418a-b6e8-e6a667b3003e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64364321-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939144, "uuid": "9728d344-cb0d-4bcb-9058-98bf9dd0b787", "comment": "Malware payload (Mirai)", "value": "a2bf296173e93b9cc10cd4d29d29416d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939144, "uuid": "8f5b8669-3031-41c1-b86e-9a83858c6873", "comment": "Malware payload (Mirai)", "value": "0fdad6121300fce5912c1886ea7c0a2950e16ba23e8908d153db6e521201556a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939144, "uuid": "10d89eae-87ad-4fee-a4cf-e01eba7a368a", "comment": "Malware payload (Mirai)", "value": "e7bcc4c44b5af2c8e7ca622ccecc3a6e38ca8bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939144, "uuid": "dc0a1e3a-fede-4653-8fca-b535bf48bab6", "comment": "Malware payload (Mirai)", "value": "1a3c68a07409ccc158327b00d98a4e5df5dbe5b51fd31af8fe17878b2c2d2eef5ec490bd1a067bd06b1d73339f79b368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939144, "uuid": "5731ea35-a613-4efc-a7b3-e8033e963841", "value": "T1C2E33A55B8828A22C9D513BEF92D018E332327A8E2DF7213DD215F2577C792B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939144, "uuid": "36250799-2aae-4210-89bb-357e657696b1", "value": "3072:GRp26H+t6SCyhDD4D6Ie1k6aUfzL6EiueCo2ksa:m26et6SCaDDceS6aGIuecks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939144, "uuid": "942a41e3-637a-49c9-b43d-6ca4131e446d", "value": 146272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939144, "uuid": "8e4b6266-8593-43d0-ae77-a9919627ceab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939144, "uuid": "3d60401a-b190-4ef0-bca0-feef5564950e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbd54fd-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921467, "uuid": "17f35570-d408-4a47-91a2-ea0f599a0033", "comment": "Malware payload", "value": "2e905aa98f93347ea93638898b18ac77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921467, "uuid": "44d4d8dc-f847-49e1-82cb-a846758d1564", "comment": "Malware payload", "value": "0ff23a77abba239a50412c720b2e423fcb3fb00e2362189cafa116eeb9bdce27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921467, "uuid": "63b54e8c-a8c0-4913-99e8-e19587352b5a", "comment": "Malware payload", "value": "c723f3f90df71f22ae3718d15cceb3d892fac6f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921467, "uuid": "91b4d124-1865-433c-8dd2-17aa7a5bfcff", "comment": "Malware payload", "value": "3321ae246318f16680788a3667d907cc06b2cb47a7d2b44b24fe8a857d64d1647613c8a4a2e5e0cd37f1593c7be2b99d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921467, "uuid": "85210884-c46c-4cb4-9b77-e417b7b8e813", "value": "T11E364A57FCA545E9C0AED1348A629252BA717C485B3123D72F90F7383F72BD0AA7A344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921467, "uuid": "84ebec8d-e7c8-4c26-89cd-41988bb61a94", "value": "49152:IJPpsCDvmLCyk8NbrRpeGICkKhhbnRI5EWOiGr9Y/zA95xwEhO:CpsAvmLCc/e6RkEBrPvxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921467, "uuid": "49371496-f59a-4e23-af4a-7eed15b8c6e0", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921467, "uuid": "c217377f-05a5-4aef-bbd0-ea21dd14ea52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921467, "uuid": "4f3036a3-073f-48d2-bd17-17950a6d422d", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5e1f3d-1188-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771941523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941523, "uuid": "6df3c63a-e7d3-465e-a65b-1ef4a9774b26", "comment": "Malware payload (XWorm)", "value": "3a7d9961f30ec040474ccdb3968e0591", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941523, "uuid": "f0c71174-6e21-4db1-aa13-716948adb62c", "comment": "Malware payload (XWorm)", "value": "11894cc842ed9eed7367aa086dbf35bb9bb913709117f767b39c7da5d798f145", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941523, "uuid": "ba40c204-c03b-429d-be66-7e2b9a9a10e5", "comment": "Malware payload (XWorm)", "value": "a3a506f8565f2e9a9f9677047dfa1fba00f7581c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941523, "uuid": "5c352c91-fd52-45fb-8a7a-f8d2e73dd9a3", "comment": "Malware payload (XWorm)", "value": "f82fcea8a74f01b4c2d53f050651bf97380626c4fe61b242b684aaaf1db63a8dd58f3a9e98139a59d769d535c796f4bd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941523, "uuid": "8b692194-658f-4060-af19-449541217605", "value": "T1AB93D0258EC90F64DB78153951FF40CA2BE9C79E5213A1CEB6337D4ADFAA60400D75E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941523, "uuid": "9bc95552-9dd1-405a-9efb-e412887a3eef", "value": "1536:L4CBuw0R9tfSad3PBKRgECbS0bTFyLLdlQnA0lLdhHXy+Y/hTrmqUkXpX:LlESsPBKRovc09Erm9kXpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941523, "uuid": "07a3d754-582e-427b-9d01-42ef2d218430", "value": 95235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941523, "uuid": "b3a6a54c-d1c3-414e-b310-9b55e33139e4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941523, "uuid": "8c393efe-74d2-4312-8571-5d7d951cfd62", "value": "Purchase Order PO#4500727683DE_10374180_401_BE25_05562NO_202600346.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f5906a-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917410, "uuid": "f9c1a096-7ef8-45e3-82ac-d52f6eaa6d90", "comment": "Malware payload", "value": "7021279e59c8de6549859fcd7bb60f24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917410, "uuid": "8d5bc6af-4e89-40ea-8403-b4471e7854d1", "comment": "Malware payload", "value": "11efd0ed325d1acab93a25c1fd6657588b57da0e7662bd165579e5ee74e8f0bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917410, "uuid": "0ea30ea1-b3b2-4140-884d-8f7e2a4bf580", "comment": "Malware payload", "value": "53afe70adb147de1991204b13468071273bdadd8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917410, "uuid": "697b2d35-5147-4cbc-a5e1-66bd880a5b19", "comment": "Malware payload", "value": "43f393753f6c6f2db62ecbf1ce429eeb2c48dd42344b1e5fcd7f82ce4edcfd1279d557c636cd55cc839261bcbefb023b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917410, "uuid": "c7e9ffd2-b710-42e8-a844-3b05f6304290", "value": "T18CD30961E917FA8E905A6BC247FB0D049F9623F8C240EB435DF8B6FAAB47E5143C0594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917410, "uuid": "4fe71089-2aa4-454d-a690-57a60e450de8", "value": "3072:CPXZ7YYqrqVqjqaqTqDqFqUqRqDq/qiqbqfqHq/q67qpqkq9qCq0qUq6qLqrqjqF:EDqrqVqjqaqTqDqFqUqRqDq/qiqbqfqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917410, "uuid": "1744329a-c840-446a-a4db-07c7fec7fbe4", "value": 137029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917410, "uuid": "37fd8621-890f-4be8-ab71-f4cabb4894bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917410, "uuid": "45c8107f-3fb7-44cd-b1e2-d326c3bd1568", "value": "invoice-1645080830.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cb8e6a-11d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771974094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974094, "uuid": "e85c5d73-69dc-4833-9cb4-a3c661a3b513", "comment": "Malware payload (Mirai)", "value": "40f915da24d76070f7efc90355180f61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974094, "uuid": "f88294d2-6516-4fdb-8882-14e6a37f94fa", "comment": "Malware payload (Mirai)", "value": "1251dedbea98e79f96ad52a009d8b93df32ae37d01b179ce2dc5c963b7185080", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974094, "uuid": "be26b7a3-d596-45b3-9877-6578768d057b", "comment": "Malware payload (Mirai)", "value": "a772c2cff945b5f5c95209e31d82bb7d9d413ee4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974094, "uuid": "71032e10-5dac-445a-a807-e4aa0a72fe99", "comment": "Malware payload (Mirai)", "value": "708d1857b1dda6c5ad8eddb2e2e42e3594bc9850b02a6446592bae22e851ce32a83ce9d91d034b0cea99b2aa856ef137", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974094, "uuid": "ee260e2c-8af8-4d17-9787-fb902e3c9c56", "value": "T1178339C1BA4BC4F5D90748708067F33FCB32E2394065D65EEF5AAE69DE336026616389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974094, "uuid": "27949cbf-c04b-4222-8ef7-84d398e6a8cd", "value": "1536:S9vLEk9ifPnEEYsok1lT6WAcDMWJScSDGLgopaTShK/:ML/9ufEcBvT6WtIDDGLdpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771974094, "uuid": "8c02827d-4011-43dd-ba99-c1acc34239a4", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771974094, "uuid": "2b88671b-408b-47b8-8b52-5f32dc0a29a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974094, "uuid": "36c2ebe9-5ad3-46b3-9057-d6cbb9a95621", "value": "ez_nigger.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a13ad7-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771963364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963364, "uuid": "c4a4813d-fa29-4db8-ab14-7e467bbf82d6", "comment": "Malware payload (njrat)", "value": "02306b018052c9b16a0b50dd7af59e9e", "object_relation": "md5", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963364, "uuid": "d9829d69-67ee-4beb-8906-835df9175211", "comment": "Malware payload (njrat)", "value": "129dfe23026a1e360b0966fb836feaefe6ddb6da11bf0282c2cb68907606441e", "object_relation": "sha256", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963364, "uuid": "6b71663d-c09c-436c-9a9e-d0afc5f3f7ba", "comment": "Malware payload (njrat)", "value": "feb969a7b78a73091e9ca95b065a9f1f99d984c0", "object_relation": "sha1", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963364, "uuid": "82ca5003-601b-4bed-88a8-b3de0e863286", "comment": "Malware payload (njrat)", "value": "ffcb60a3694126da93514c19098b912f046c7c71a41d5801a9b40a703a0d260cdca635f94bda86ab4b227faad23f16e3", "object_relation": "sha3-384", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963364, "uuid": "f85f6667-000b-49b5-92c3-2dbb2dd4b370", "value": "T1F2F25C083BD54229CBFE7FF95AB366021770E5079A03DB4D0DD88A9E6B277C589007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963364, "uuid": "986f3d2d-b46f-4daa-ac5c-762155173231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963364, "uuid": "8c8e3ae9-88be-43af-a52a-a904b74a1dc8", "value": "768:+6KkDnV2jZgWSVO9+51TncZ/Fn9i/6TOMh53T:+fb8cwtnc1Fn9i/6TOMDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963364, "uuid": "64afbc96-b5ee-4e6d-a91c-7bf9b7ec3fec", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963364, "uuid": "e76ea114-7794-40a0-803e-d10200b5f4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963364, "uuid": "9ed6aa60-3b38-4403-ac13-68055aa70b5c", "value": "yunewfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163272be-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771957052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957052, "uuid": "d29677d5-109d-4a68-8214-de1051473190", "comment": "Malware payload (AsyncRAT)", "value": "3e3190d1786af7fec3b448e845d4f3de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957052, "uuid": "cd81cfaa-6190-4ad7-9791-200aa6f3627d", "comment": "Malware payload (AsyncRAT)", "value": "12c630f7b3ff1dc17fd133cc1c8721852e4b0dd1899dcc391f874e38735fd313", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957052, "uuid": "e323d52e-b980-429c-b4a4-581fb2e5f5bd", "comment": "Malware payload (AsyncRAT)", "value": "0fa4236cd9d059e1039a4db79bec41f75ba932bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957052, "uuid": "ad4f9392-089c-4ba6-9587-df3110cdc9ee", "comment": "Malware payload (AsyncRAT)", "value": "3b5dfa1a7580ad73aa306a497f81e0d30fcf28587f9ea92b8a7091c2cc6d4c59a828e3d6b9c731fa40af815f009dadd6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957052, "uuid": "736d2224-7bf9-472d-af9e-b29da3b1c464", "value": "T1D0045A42B7A1C2A1E0B94E73D497E9F14F32BD5BEB06651F3084BB4B3533141AD13A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957052, "uuid": "3337efa1-93b8-4624-8b8f-741a45ab35da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957052, "uuid": "6c9814ce-2359-4709-9958-a07dcc2d35bc", "value": "3072:7PgD2RNvTdbNSrNBOQm5mz+Bz65/M6If+3Js+3JFkKeTnP:U2ZbIrNvm8z+xBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957052, "uuid": "924ad49a-dc30-4366-9de6-705ce958116d", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957052, "uuid": "d3666fef-ff15-457b-9277-d089bfd0fdcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957052, "uuid": "bc7bce8f-227c-49cd-862b-bc244cb6f3e2", "value": "XWorm V6.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6997e06d-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919396, "uuid": "2aa40b17-2225-4c39-9c72-70c13308c11b", "comment": "Malware payload", "value": "2bbab86f41d34fdda7b436dbf73ea389", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919396, "uuid": "1f09430b-3d89-4aed-95f5-d701c01a51d9", "comment": "Malware payload", "value": "140a1d690f03fafd4d93cbd2b9d4fbe42cfc163cf725921ada1c2054e6a2f6ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919396, "uuid": "38adeb05-77d8-4327-b84e-eb4e60eb99ef", "comment": "Malware payload", "value": "7ed6bb2d2cdad437d07c3aab712ddd92a3f489d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919396, "uuid": "096ea2ee-4220-474e-862a-42c30e9657e4", "comment": "Malware payload", "value": "9ccda767aee77f4ead1aa5882fde579ac108233842582f8a00bb70cf6b2d3c8029d137baf407528c906501d9c499d196", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919396, "uuid": "f147eec6-0136-4ba2-9695-024c337bf2db", "value": "T10FD3D92F9ABB11202A5B3EFDD19C3D697ADF42A1B1DC4585AC90973F4776960408CCE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919396, "uuid": "0da21783-19e3-468e-bcde-318db5711e48", "value": "1536:CPXZ6uSEY+O8OUOJOOOKOwOoOvO9OSOiOwOXO8OgO8OBO6OdOROFO7O9O8OTO9OJ:CPXZ7YHapiiZP4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919396, "uuid": "3b080aa4-778c-473c-9a3d-34e3612e53fe", "value": 142804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919396, "uuid": "42c05d8e-1d7e-4335-9278-ec3684dfcae3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919396, "uuid": "6f69693a-9db8-4029-9ded-841f88706b79", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4815ebd2-116d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771929648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929648, "uuid": "cad5ed7a-ea88-42af-ab0d-b8da791e5acb", "comment": "Malware payload (ValleyRAT)", "value": "717422a0ce206176de42f92018191c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929648, "uuid": "a99382d4-82b2-4c64-ac5b-4c7a2c8c763b", "comment": "Malware payload (ValleyRAT)", "value": "14e5b567d4601f1d91287fac2134320313cd829f19cd5912555f0fb5144a611b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929648, "uuid": "025ac86b-d66f-489c-a95b-fd59d8ce5f5e", "comment": "Malware payload (ValleyRAT)", "value": "9c8f0b3fe2d6a5f335654c8d30e6d742a612918d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929648, "uuid": "b91c78ec-7efd-45e2-8017-9efcb4f40163", "comment": "Malware payload (ValleyRAT)", "value": "fc2c752b5fe87cbbe49ffa93ca551da00a1ce5b485dd15dd274b4cf5fcd5b74b38554f3b8e2a29a841a9b3cda9be3a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929648, "uuid": "a76b1151-6945-4e2c-8ca7-64de365adbb4", "value": "T130146B19B7E500F9D0738238C9914656F77378561760ABEF03A0837AAF23AD4AD3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929648, "uuid": "dedf1179-2a2b-461f-902b-e85c6234ae1f", "value": "41732eb07837bfb146ccc121dc0d2cfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929648, "uuid": "4ab1d2c0-8672-4ceb-93f7-470381bb07cd", "value": "3072:W8TgX4A8NIGkPkwCXqMXXOdYtAnOxoGFUdP+pzl9/ET6jJEA6mURAitAns:cb8NYrCaEXOd5OG4yP+qeUtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929648, "uuid": "a0c228e1-96e5-4d2f-9f1b-1e2c315f283d", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929648, "uuid": "86185bff-62c1-4d4a-8487-9ba47af2be48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929648, "uuid": "1a91bfbb-3c27-4ac3-b43a-6cdebce0d123", "value": "14e5b567d4601f1d91287fac2134320313cd829f19cd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1875f5c3-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903798, "uuid": "debc7d0c-8dce-4f0e-b5be-f456e8cec599", "comment": "Malware payload (SalatStealer)", "value": "2104b4130d63db5e5167f6502d50b92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903798, "uuid": "5b4bc61d-9ffb-4280-a629-c94846b03d24", "comment": "Malware payload (SalatStealer)", "value": "150ba8d5af773f106e95072e087696493256dc8856005be726c337e3bd86d105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903798, "uuid": "16c8eb97-c0f7-45d6-a404-3b328d2dca40", "comment": "Malware payload (SalatStealer)", "value": "ecca3458aba54ab9c9b2d3f7a0ddb035c4736248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903798, "uuid": "d8e041c1-988d-492f-9270-80a1ba606e7f", "comment": "Malware payload (SalatStealer)", "value": "de6fcf4fc1bdc251c2bda7fea9cd7af328848f4cba9bff79e28c0a77619b382c17989bb8f882c63c0f52890b1b83a1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903798, "uuid": "070901d2-1ca1-40c2-8a27-546f23335684", "value": "T111C65A55FACB44F6ED03183140AFB27F23315D058B28DB9BEB147A2BF877A911C66609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903798, "uuid": "e470383c-4871-4650-bc30-574d047b6ef2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903798, "uuid": "5998f522-6b69-4301-bc30-63f809b275e0", "value": "49152:uoQnWAOqx69FUbzD73B7ypthjc6p3yujEQmcg26N0OOgvfpHxKGost/B/DG90idH:rAWAODU35GpDg5/5G91UCk5Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903798, "uuid": "e686422b-c3e7-46a9-897f-940178765f9a", "value": 12085248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903798, "uuid": "7a72aa59-6097-43bd-8552-f98fd8b2296a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903798, "uuid": "8318e593-46c1-494c-b96c-b7f4749cece1", "value": "c4dak6pf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470baf8e-11b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771961858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961858, "uuid": "56dc651f-d360-466f-9632-932e9edc3ede", "comment": "Malware payload", "value": "410cb81162ec36be6d0aaac659e69d87", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961858, "uuid": "edf80ef1-dca4-402d-9991-2325a18efeb0", "comment": "Malware payload", "value": "1527ffe43de6ba0434539f610495f129d8b120cfd5e8f61a6118f6f6f8d03fa7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961858, "uuid": "2dd1db34-0f0d-4109-a554-b04c6a2c95e8", "comment": "Malware payload", "value": "4cfa38ab2818306b6253fa8a68007607a4f15926", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961858, "uuid": "d8edd013-cb7c-4f02-964e-9c0d57bfe216", "comment": "Malware payload", "value": "65df4735984572c688f54529147ffd12f4faf7088a3d0c1df201ef66a7dea0d9b0b1837cc6112163cd9c8f631390018a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961858, "uuid": "948a1002-9d0b-4e5a-bf4e-7f2d2dc3e915", "value": "T11FD5337F83B605D2C3DC0932D80E163AEFD8AF32DB2E0B5BB14D84557A562C465B4B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961858, "uuid": "771d79e8-579c-4944-b691-79e90bbd8831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961858, "uuid": "0a392e72-ada1-4d7e-a27b-93af3ecbbb2d", "value": "49152:92CdG9o8T3OnYqpaCsG4W5wNjL4TX+xBzfvZOT5wxtyzVjJRfGO/1PVTx8uyR:9rdurQYqpaCX5k4T6ehJJVPdxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961858, "uuid": "466e816c-9c81-4e04-a85e-2ad45e0149c5", "value": 2956800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961858, "uuid": "09d074ee-16fa-4030-95cc-0a195e801042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961858, "uuid": "70bb8baf-796e-4916-b996-b293115e2263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e488675-1187-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771940906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940906, "uuid": "269b43ee-6aff-4417-a1ca-ad6e82670d82", "comment": "Malware payload (QuasarRAT)", "value": "7f3f122bfd178ac14d59619324880f0e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940906, "uuid": "d28bb81d-6a5c-46bb-a822-55197c339bf2", "comment": "Malware payload (QuasarRAT)", "value": "1595d92fb580ab1264b533c3504863062bf47d8ce61e838c64179b904f2a6d23", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940906, "uuid": "42e4de87-783e-4d06-9815-763f219bea6b", "comment": "Malware payload (QuasarRAT)", "value": "08fe27a17b0b621795a620386bfae71686c227b1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940906, "uuid": "d38fcddb-912a-41b9-99b2-9f04e116e077", "comment": "Malware payload (QuasarRAT)", "value": "4bd1eae98676f18fdfc93e89a89ed63328cadcadca220b93c51a88da8cd2b14c6b734032fdc1005ad44dd0f773ad8957", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940906, "uuid": "2f51eebb-99ff-4567-b62d-b9b199fd9a6b", "value": "T160F52349ED40CB13C6622D33CA61236071B3A8670782F392EDD5F9A9D0B73952F49B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940906, "uuid": "446caf9f-61e9-4020-b97d-2436711c6b50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940906, "uuid": "75752a93-1439-4f1e-8760-38303bf7649f", "value": "98304:vdMc2x3tmRxhYOlFWKIvJHyWd/XLcIPwEc:v0x3tmRxhFIRtvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940906, "uuid": "997af082-ad93-4c57-9556-7d091ac1f4bb", "value": 3503616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940906, "uuid": "9a5ed400-70ea-431a-b36d-132360c0f4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940906, "uuid": "17e25e77-1bf4-4db1-882f-69821a2c45d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22744157-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919277, "uuid": "4a911d5b-09c8-4d71-b407-1f798f1ea70c", "comment": "Malware payload", "value": "7b3d5faf9a04d88df9771f99ad398e00", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919277, "uuid": "de7243ed-79d3-4bde-a87d-6ed0a5768045", "comment": "Malware payload", "value": "16e5a3e2fa1a4ee52862c1f21739abe01607edb5083734ebc0496959e2040f30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919277, "uuid": "c11e125a-22bb-4013-a1be-8c97672d73dd", "comment": "Malware payload", "value": "0e053d817e2b7610bcac70fa6febe507bacf87f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919277, "uuid": "c0e8e320-880b-4a3a-b796-4c40015c4ea4", "comment": "Malware payload", "value": "e9ca3bb197dec801f5cf66791353932640225fe6c18215c27d854680a1e1eba456da1be255bf22a6779a8ec0fb278dad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919277, "uuid": "1ad46411-231f-44b2-9023-c6f915996cf1", "value": "T148D3B693FBC760E6197BDA9460CFA82B75E134C605A19CB08A96FD74C979D82C132D33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919277, "uuid": "7f580515-f2ce-4703-9333-cb60a0990ff0", "value": "1536:CPXZ6uSEYOPmlC6rRZreK7nNpGzjBOfH0RH7WkCQ/QG/CFWM6IVb4lhxMIZVb4qn:CPXZ7YbNpr4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919277, "uuid": "deb1b2b0-7d81-4065-b42a-7857c17bfdae", "value": 139951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919277, "uuid": "7aa04803-9f7c-4ead-832d-e4f32f9107d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919277, "uuid": "5e012cc7-14b8-4c22-a49b-93b6837c0b48", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2996fcc3-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919289, "uuid": "0a5efa67-9db8-4574-8c42-5a07a012694a", "comment": "Malware payload", "value": "ddbb6f8f44bc8ff35c7f0e5490105fec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919289, "uuid": "647bd388-6dfc-422a-b217-84862236adad", "comment": "Malware payload", "value": "16e820dd604d252f6cbcbc1c583dddff3e612ec013daebc85272145c48fbd2b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919289, "uuid": "01be25d8-d079-4063-a697-4d88464463cc", "comment": "Malware payload", "value": "96b9d1be275e0b9f2075f8e81d0c10c8810de683", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919289, "uuid": "46320837-5d41-4827-94dc-114c83025873", "comment": "Malware payload", "value": "4aeaf279428d2eebfecdb1a140adcef6020953df395aab88c05699c223c854be575940c4107348b8307f6a8acf3f4f50", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919289, "uuid": "b23a2f69-c064-40ba-aaf3-947cc6fb4736", "value": "T1C4D3C5F26138B8CED431377EE159BA8D03ECB6675389D1CB51925E2E312E0DEE351892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919289, "uuid": "c8e1db4e-8b45-46a9-ba69-44b4f97080b4", "value": "768:C8m/Z6sZjWsYuSwnckNuRAqJaFupEwcxeLScFYHXwz04mYF6F2r:CPXZ6uSEYcFupC4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919289, "uuid": "57426af4-1ad2-4b93-94bf-1a6dfcbad0cb", "value": 137990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919289, "uuid": "9cf10f0e-3382-46e1-a20d-80fa69abac78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919289, "uuid": "b0ee3b60-c5ca-405c-80c8-6bdce20b1649", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06bbe7b-1168-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771927649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927649, "uuid": "44f0fa83-df84-4eea-ab7f-8840b0d8abe9", "comment": "Malware payload", "value": "cff562b3acdaf3ed40876cb720f00fbb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927649, "uuid": "f0db027a-c278-491b-9e5f-7702ef5aa8be", "comment": "Malware payload", "value": "179312a53fd4c0a2a5878205afcd34b23383e39ccd447a46d226adb20c2834e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927649, "uuid": "036c79d6-8939-486f-ad73-e8e2c9f2f1b0", "comment": "Malware payload", "value": "f6a953a1f12dd7e947dfd51138a89b3d0d4f08ac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927649, "uuid": "bbe1448b-ce35-42f5-a317-451b14561ff5", "comment": "Malware payload", "value": "e04999c21c664577407ab80e9c1dadfe330cef2bcda43c8921d7ea5003a863e3f52fcba6ae24559dea6bd8707d7cb155", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927649, "uuid": "779205c5-f691-49c0-addf-593b3f343ff9", "value": "T175D40217A3A2BEDBF80743365CC41955A10F6CA0971D881F39C7B31A597B2B7A1A732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927649, "uuid": "1a74f2a4-2c35-4b4a-b580-72a7131fc2d1", "value": "12288:Pg3GhSnccGrSQbg3GhSnccGrSQrZi+V6:PgDnc5bgDnc5rZix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771927649, "uuid": "ca3ac3bf-238b-44c8-bcf0-72e9697b122a", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771927649, "uuid": "e9d97a2d-c7d6-4e96-85c0-dd93d6c5a4f2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927649, "uuid": "c05a01f7-4141-4212-bb23-047271cd1faf", "value": "CMR 1- Ex, 2 invoice, insurance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178df8e5-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771916682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916682, "uuid": "6003849f-f2ed-4906-adc6-e6f46be604aa", "comment": "Malware payload (XWorm)", "value": "8b5e38dddace5837fad435eea9e5696e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916682, "uuid": "5a707dc8-13fa-4454-8932-5064efeb3a22", "comment": "Malware payload (XWorm)", "value": "1840888dad93f74d58bb3f7609a031aa3aa4077b74c40c2aae66c6856ec0a3e9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916682, "uuid": "7f1eafe3-b12f-4bda-ac00-9a7095b32155", "comment": "Malware payload (XWorm)", "value": "4eb14b303fa9ad536b8aadfc9adfdcd1324c65f9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916682, "uuid": "985e80ae-0698-4002-a9b9-4340bd177fda", "comment": "Malware payload (XWorm)", "value": "8dd17a6b9ace35c114951f1a05dafdde65293645b378fb61a40cea8e756fc7dec0badf3203631d0ebaa9e70e4b3fb722", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916682, "uuid": "644b2145-1b81-473d-b429-0417041d9b7d", "value": "T103B42223ED02BD604BF89232B4ABD909FE45431F5444D81B3FBC54DE0F3A9568A1A5DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916682, "uuid": "b06a9ead-2dc0-4169-973a-2126bb0a394e", "value": "6144:VRXqWQ761KP+Ye3HNFdEv6w6iu6Fv7lngAbbHvNVZ2F5/DZHgyJGNW4QBhwvoz2:DXqqK2z9Fs6wtvhnBVq5LZHgyocrnwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916682, "uuid": "81eacc56-1e00-443d-8549-a5ef13684857", "value": 506927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916682, "uuid": "2ed92fef-7279-4a41-b55b-cf0a6e695b84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916682, "uuid": "097eff8b-1e68-47a3-9dab-18c49eedad4b", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39658a24-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950239, "uuid": "d62e06f1-7a58-4e18-a1cb-017b99ecbd22", "comment": "Malware payload (Mirai)", "value": "a7be90bf7f767e52e0315acb5e7fdf79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950239, "uuid": "e8eae6d5-9414-4e92-9e4d-f494afaaf5ca", "comment": "Malware payload (Mirai)", "value": "195ed5e7fd690a33c75a688ccbc4746b752f536d34a219320cdc1463f3b37b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950239, "uuid": "690e5ee2-8fdf-40f6-a254-e37b76f99d84", "comment": "Malware payload (Mirai)", "value": "69f944d3ceb95182c4f740662966aff86e907ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950239, "uuid": "b28ffaed-d4c3-4518-997e-65e533024103", "comment": "Malware payload (Mirai)", "value": "235a28007243a909eee4b13a16a1240cc9bf0b693497cffa3521ae29cb25b1f271ccc99e37c7c830973cf463677724ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950239, "uuid": "099f143e-8759-4a44-9665-e0250f6b2f71", "value": "T15CF3F745B8518B16C6C626BBFF4E42CD772A2768E3EE7203DD156B24378B45B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950239, "uuid": "7c901943-970b-427c-ae0b-37280a948c9e", "value": "3072:3nAPwxbUbTILSE5l2EoB/IC97zil4hzP/en2WL1AZf58:3APwZUbTImul2EoB/IC972l4hz/en2st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950239, "uuid": "3463b7bb-96d8-4b92-8a08-5b7b4b272f64", "value": 159960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950239, "uuid": "1e46a1ab-ce78-422d-91f5-c867f80e645c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950239, "uuid": "f71b3a4e-f6b1-4886-b44a-129fe18a8b68", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87e9663-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771963310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963310, "uuid": "469a83bd-20f7-4410-9144-0a250315e1bc", "comment": "Malware payload (SnakeKeylogger)", "value": "4986882a7c8c9f798c7e227d58cea23b", "object_relation": "md5", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snake Keylogger", "colour": "#347020", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963310, "uuid": "d63eac70-7646-4d97-af81-a56669fb9ffb", "comment": "Malware payload (SnakeKeylogger)", "value": "19fa8248db9c675faf5f0ce3809118a391d9bb8ce253ba31046490c9b10b7e5d", "object_relation": "sha256", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snake Keylogger", "colour": "#347020", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963310, "uuid": "53aabba6-86f8-4c1b-a50d-6a61d6fc9e3d", "comment": "Malware payload (SnakeKeylogger)", "value": "21adc94c442baaa131c3b5584c4a54bbf11c07ee", "object_relation": "sha1", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snake Keylogger", "colour": "#347020", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963310, "uuid": "a0d0205e-9cbc-4f34-a613-d7c40027c86e", "comment": "Malware payload (SnakeKeylogger)", "value": "506aa34e943084041ef3a5493139109cbb06f342e440c5c920db79324744a4f5cd5d7636ce8931b7a2567705b23253fd", "object_relation": "sha3-384", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snake Keylogger", "colour": "#347020", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963310, "uuid": "a7ae7567-27f9-4ea7-97e2-b8686da95f50", "value": "T18C44A60AAFE89C10E2FF847792B68115C7B6782345299D1E57C1F8063A3EA549F07F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963310, "uuid": "2b901e2b-a33e-4454-b483-a2f26a725e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963310, "uuid": "20435af4-f793-47ef-a856-0f404265c11e", "value": "3072:keW8JdZr48k8HHL8L/x8r98PVd6Yn+EPAZp4BfxbvTGEnsouUY/Vg9iGbbY:P4bzPBnfxb6wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963310, "uuid": "44b94091-1e22-4eca-8980-c5f1bafb0c7f", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963310, "uuid": "6a3fd637-7c0e-440e-a25a-92249c6d7fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963310, "uuid": "fe02ac29-fe38-409d-8d5e-a35a38843f10", "value": "ugooilnewsnake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcab929-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917447, "uuid": "bb281ace-62bd-4735-acfe-fd87eec89be9", "comment": "Malware payload", "value": "a236113d8ff6dfee65381a6a03a0257e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917447, "uuid": "9c215905-fb9a-404d-8fda-a457a36c1967", "comment": "Malware payload", "value": "1a197f4ade5277afa8e581357b18b3ff3b650b610a39e76f24200b9ff02d09d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917447, "uuid": "9a245a25-029a-4b93-893e-dd5e33fa3abe", "comment": "Malware payload", "value": "9687d07414eb64bd835e17e0ebac4aa91709f71f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917447, "uuid": "f2f141af-2e0f-48fc-a7cc-da0fa51a267b", "comment": "Malware payload", "value": "e9bd3707121370b559988a44e8190f9b5e8de52acd4b8fbb70b29fc0102578b2a433d5eb90404491ac12ee1f5ebc2f8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917447, "uuid": "68d10395-6983-4148-af77-66d417a24de5", "value": "T1A0D3EB4EB033F52B8A7F5B149CF6D9F84AA0B5759CB0A24C51C560D60F09E02CFA69E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917447, "uuid": "75687d78-87e8-4249-a764-4d9ce644c847", "value": "3072:CPXZ7YSUZPM7OnlUPiAQ0gXsToD87DUddq70rw0omn87ptN7wIgIIUZNgvfxqgQs:E/UZPM7OnlUPiAQ0gXsToD87DUddq70j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917447, "uuid": "31755665-22df-4422-bdf0-631059a8a370", "value": 137001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917447, "uuid": "69ff1214-ba14-43f6-bb5c-f96f78a30c01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917447, "uuid": "7ce8f028-ba6b-4dd3-ad06-7a6f3843c172", "value": "invoice-1645080830.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0172a966-11a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771954440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954440, "uuid": "63ff107e-a407-4538-b43a-3acf05a6ff8f", "comment": "Malware payload (Mirai)", "value": "01831d9e9d1d922e66550e755db5b919", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954440, "uuid": "cc3ffc47-5960-45a6-b62a-30908ac00b4c", "comment": "Malware payload (Mirai)", "value": "1a2dae527b7bdd9517b083dd29a3ff2d4bec819bc07bde637b225ea2eb9aad5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954440, "uuid": "deeaf0c8-4e88-4cb6-988b-faec7a806b01", "comment": "Malware payload (Mirai)", "value": "bc331f9faebd7e11f2a57342b633c137db340caa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954440, "uuid": "4e48e13e-9712-4533-b51f-d13375160f60", "comment": "Malware payload (Mirai)", "value": "4c486f50bac75d9a5f35c6c5da07a928d2276b18473de7e918976ce780c4bf93681bdca9c29c5f0ab15eef88164af294", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954440, "uuid": "bcbc79de-2a73-4f3d-aaa0-68e1d0e72bc6", "value": "T16E0180C472B0B07274EE7467CA301D9D318A905A38CA2C98ADE5B0D5D9D5C04E2307AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954440, "uuid": "14046d4c-5a25-4f21-a04c-e53440ff9513", "value": "24:ZDkH/FbFFeEGLnBXwQvU5cLvKGLnBBvUDcLvWeD:hOFbFFePnBXwQRJnBBje6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771954440, "uuid": "887c07f0-6591-447b-94de-dfa86ceb0084", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771954440, "uuid": "b113ea6d-c2d9-4b60-bbd1-d02926b058b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954440, "uuid": "8c555b27-4bb8-4fd7-bf77-24d1298e71b5", "value": "1a2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cdcb74-1165-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771926334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926334, "uuid": "070bb6e1-7dfd-4b7a-a601-8f104368d77c", "comment": "Malware payload (CoinMiner)", "value": "4d2dc88cbf52d841ae9a74ccf94a2e7a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926334, "uuid": "2671204e-3d79-430d-a67f-3359dd352099", "comment": "Malware payload (CoinMiner)", "value": "1aa2ab7ae7ba86b114bc36b70b95cf848df4fc8ece90bc909ac23bee688acd05", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926334, "uuid": "488c7f52-8de4-40f0-9157-4a0bf6374171", "comment": "Malware payload (CoinMiner)", "value": "d5fcf0279e5562b217a4efb41bb4a18abe84a823", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926334, "uuid": "d78e16e6-94e5-4a39-9c62-4a73af39e9bd", "comment": "Malware payload (CoinMiner)", "value": "ac81b2ff301d85f05f7c4b5b8c3cabe576a084866454c00e01eea88a91bb13c0655f05b796869cbeb3f9cc6c151794ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926334, "uuid": "9fc9eb1b-14f7-4579-bbd5-24f70941cbb5", "value": "T1C237E013F8E20894C8FDD2B0957A8226E971784D0B7523DB57A0B7742F337E15A7AB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926334, "uuid": "e93c48ff-8452-475e-a54e-c05de4bca64b", "value": "393216:TUbjHsd/iPqXPHCkHFDlcugmERcS0nc77YeiD526BPDmmERcS0nF:obnkHJlVY0Ph5D20F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926334, "uuid": "c3469d85-2258-40b9-9960-95162685e546", "value": 24023175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926334, "uuid": "1f15ef13-9257-46ed-a894-b9a7fae5a152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926334, "uuid": "3951c305-fc40-48f4-8cc9-d90a9704ac0c", "value": "syd-api-01_1771885459_elf_BcVsmONR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f23c74-1131-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771904091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904091, "uuid": "0416e637-01d8-4733-80d9-0e75c901960b", "comment": "Malware payload", "value": "66b7e6eac5bbbd208ab50d197d633a81", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904091, "uuid": "ea303cf4-17a2-4166-a0bc-728ac9b8a9ce", "comment": "Malware payload", "value": "1aa916abae67df3b5d2087eab2695d46527095fa587c02e415318d6d23e4bf6d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904091, "uuid": "8d6ef446-509e-48ac-9317-fd9e7dab2929", "comment": "Malware payload", "value": "828b4bef1c131956928591a55a354d1fdb14f158", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904091, "uuid": "e8e860e7-3fc8-4918-86ff-3e31578951aa", "comment": "Malware payload", "value": "e6f5eff49eacc37da750b8e0a137fe454128a9d137f5403b7eb26b64d81d56e92aadb8fb1ecd05480b153a7239d656b0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904091, "uuid": "1875253f-cc58-41a0-8337-f1eaee23455b", "value": "T1B1D4C026228B15FEC77302B1E6521277A6373072573892DB01BD852D1E2B4F997FBB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904091, "uuid": "32e98a9a-b2ee-4f4a-a334-68a854ae0849", "value": "deb98907f1d66e53f609f6f9b20afdf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904091, "uuid": "8971ef8e-5a34-4d97-bb5d-6640d2cb747d", "value": "12288:gSdABr8EF2TDa1rCyfF2IG7x8nhsiWtZAQU9K2pn/ihWB6eeCPOYYYgYecJ/OQsf:gaABrxgNQDha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771904091, "uuid": "92cc64a1-2002-4a00-a466-ea91e3e64ea6", "value": 624792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771904091, "uuid": "12f3554d-586c-4cff-8fad-c56bb3778ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904091, "uuid": "ff131c83-4203-46b3-b1a1-b876fda9f1e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a45a26-1118-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771893224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893224, "uuid": "22894dd7-9c27-452f-8b80-5ca5bf7d44cc", "comment": "Malware payload", "value": "372324decd80c9985e06b8a4b66bfdfa", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893224, "uuid": "f8278fe5-cb02-4800-86dc-6669c8ac81c6", "comment": "Malware payload", "value": "1b5c10f6101a90728b135abfd9879da78400b7939f0dbd2c851b30ef51c8276d", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893224, "uuid": "762c8319-0ac3-414d-a073-aa98e930e2e9", "comment": "Malware payload", "value": "d868df5acfb021e3ed468b1b23de88ae4724d971", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893224, "uuid": "156f3f61-783b-43f9-ac23-b4f33fc2613c", "comment": "Malware payload", "value": "2043cf7abb3950e73ec60a720d3be030c393c3f556573649076f91e674f3cd2b3f60d9600145e08dc392e5f50dc00601", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893224, "uuid": "b91ce0b1-88ac-410c-9d55-580d10ce1b2d", "value": "T165544B4A73A440F5D8A79139C9A38A46E7B2B855077193CF43A443B95F3B7D09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893224, "uuid": "3186b3a9-dcd7-4008-bf3a-0a8cba8840ad", "value": "b31da0971f03ad8d978723cd8ca7b5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893224, "uuid": "ab96539d-c55d-45ca-a82a-8278787f0f8d", "value": "6144:r5tTACTcSFHR+2noN9jxsTXqmTKo28LX/bh+27:rnldAxsFTh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893224, "uuid": "7d053099-12d5-42ea-b2a6-be2512f356da", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893224, "uuid": "eee2867e-d4d4-4d61-84b6-4c6f58e90dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893224, "uuid": "d12ce7e0-c47c-4e4b-842b-6fd19ef479de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d8e691-1184-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1771939816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939816, "uuid": "11960367-e479-4b42-a088-cd7be6b628c9", "comment": "Malware payload (STRRAT)", "value": "201335ec3d0506fe45a5f793f9190fb6", "object_relation": "md5", "Tag": [ { "name": "23-94-206-26", "colour": "#C8C311", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939816, "uuid": "54ef00d8-25ae-42e8-918c-2e9de7f28872", "comment": "Malware payload (STRRAT)", "value": "1c07c3eff0efd95822fe3db3878093b225d459022ebc2625574c33d84113d15b", "object_relation": "sha256", "Tag": [ { "name": "23-94-206-26", "colour": "#C8C311", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939816, "uuid": "0a0c122a-3882-4470-8e1d-0a91577f8368", "comment": "Malware payload (STRRAT)", "value": "ee6351459e638e23d615ca12e8f67a45e95561f1", "object_relation": "sha1", "Tag": [ { "name": "23-94-206-26", "colour": "#C8C311", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939816, "uuid": "dbd901c0-027f-4349-b402-60c980e3365a", "comment": "Malware payload (STRRAT)", "value": "b12f0cb6abb55e579b9ff55dd6733541e1acb017c061697ef8f5273284c1df64a035c5c3fbfe50001126d11b03d2a654", "object_relation": "sha3-384", "Tag": [ { "name": "23-94-206-26", "colour": "#C8C311", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939816, "uuid": "a1818ea9-6958-4755-a6ce-c35280ea0a12", "value": "T19FF4F1214B841FA4DEA85A0BD0BD4A1E57F1078BC619B4DDEB23BD07AFEFD04411A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939816, "uuid": "52c708d8-5d1c-4ba1-88ad-d909e45a5820", "value": "12288:Jj4KmImYEs938FFchbJ0xIziezWVCE1LRzOVGJcgNiMQJ:aKmL4meieI9nNiM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939816, "uuid": "e341f5a3-50a0-470d-9b04-ebd587935d42", "value": 783771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939816, "uuid": "22150cee-b1a5-466a-8857-f95c9e9945bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939816, "uuid": "242e08a5-7d30-4bb7-9fcf-5743d1a36c53", "value": "Proforma2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70df3c7-11d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771974099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974099, "uuid": "8bc23e77-ba40-4b01-946b-61e6660d5fdb", "comment": "Malware payload (Mirai)", "value": "43f07fb56dae671c286fe1031bdc5d6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974099, "uuid": "b5aaf31c-bd6f-4859-b2d3-592a29315240", "comment": "Malware payload (Mirai)", "value": "1c1d7320d99e59fe8cf5b88659bed7b0b7cce808ae528c26c18c3ee7b9180045", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974099, "uuid": "e04ac71f-7b45-4e9e-bc1f-23cfe0df23e2", "comment": "Malware payload (Mirai)", "value": "2dd1faf767d0f865020e1e4b5dc71b3d0aa42e8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974099, "uuid": "7477c7c2-e363-4a42-a22c-999ad7aeb52e", "comment": "Malware payload (Mirai)", "value": "dd4b4f12737b8ceb7e59aa1ebd969f5210a2035c4fe486624e5842d395c19fe2acd5fc2bb76ec4812813aa059c278ff8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974099, "uuid": "24563b9d-5c03-4545-a6db-0d1eef364468", "value": "T1D5C3C75E6F218F7DF768873047B38B21A75933D626E1D685E2ACD6005F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974099, "uuid": "635b8fb4-4588-4c8f-a9a0-0fdf123ef7f4", "value": "1536:78RKnVkRae4eyJjkSwNIzoPJYkuSPpI/NoB9BzHL864eDzeh2Of4TpJRYF:4Kn2Rav5kHjvyS9BzHJ4eDI4nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771974099, "uuid": "d6c9d793-82d9-4c91-a55b-2565100e6ebf", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771974099, "uuid": "58ab5cb8-8e56-4c57-a7b7-1506fb9c9212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974099, "uuid": "6fafa10e-9a5c-4e04-812a-afe4a6c56cd2", "value": "ez_nigger.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53714edd-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917641, "uuid": "890ea70b-82f9-4e72-9ace-0e38f92e7c52", "comment": "Malware payload", "value": "2e0a599e3f549c7f8a3daca00a8c8761", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917641, "uuid": "0d578046-3b49-4b18-bc43-e379bc23ea93", "comment": "Malware payload", "value": "1c5837087dd850512750ccbd42a6ab66182dcac273620d28df1aa15f50e6c057", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917641, "uuid": "80840739-3e1a-4e56-8952-981b4bf9a699", "comment": "Malware payload", "value": "f466920f0cf18b251777303b57f841164418e92a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917641, "uuid": "6fcbbd33-bfb9-4bf6-8b6a-366f222f4d70", "comment": "Malware payload", "value": "2528682c94167e1ed56de77f7eb7faae0f53b79cdb7f52a01088177968a26a1882f5658e329b9e8bd8649bdb4e7012fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917641, "uuid": "9aabdb8b-fe74-4fe8-b334-995124539048", "value": "T109D3D8C52A3EC35D899D139C4A723E06AB7BFAF04E41FD67BAEB11404E2A0577394847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917641, "uuid": "c8f82074-464b-492c-9fab-a93f816192d6", "value": "768:C8m/Z6sZjWsYuSwnckNuRmqxcGWmXNyIEpk0QV16G9Yj9xayr42fM1eyj9M1Lp2e:CPXZ6uSEY8plFS4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917641, "uuid": "3fa6347d-0da5-4ccd-9124-82376f1679ed", "value": 137993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917641, "uuid": "3485066b-35e0-4db5-a632-babd90f6a91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917641, "uuid": "c173d865-92b5-4e37-9018-8bb1c2982c3a", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ac7d4b-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917559, "uuid": "59cd52de-920b-4b56-89c9-8269fde4c7b6", "comment": "Malware payload", "value": "ef33b3492e4fa8afb071706cfd1432b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917559, "uuid": "18c23678-fa65-4d19-a59f-d5004a650b9a", "comment": "Malware payload", "value": "1cc659c685df5f8013dfdf8f5f39d6f76bf639a4e0cb4aad2890d1d960141306", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917559, "uuid": "fa98a04c-8c24-470f-8f66-be7626cbf101", "comment": "Malware payload", "value": "424ec9a9b3925dfd29f378a1a295b137a271045b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917559, "uuid": "7fb1dbde-47a6-4f38-aef3-903c26fc94e0", "comment": "Malware payload", "value": "0b0119ec1ba2a401621217ff4520543093b0477ecaed0ef4e92cde9a572dbfdb2e074a3546d9da5aa21f3d880ed1342f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917559, "uuid": "327fde54-29e3-4adc-a4ce-bad0b4bc5717", "value": "T1AED3E80705CA359B6695DBD0FB9FE1739836E26F23A4BC39344063F19295B28B473932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917559, "uuid": "a42ab1b7-d4e2-4ad3-bbad-1965d0b7e6eb", "value": "3072:CPXZ7YQ05wX4wv9dfN4LrE6dvDZgd6mdRbrlaq+wuaCTFuDPMNFyXzVGqdXV4r6Z:EXDpaX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917559, "uuid": "e9fce5b2-c135-40f9-8acd-3dd23b9824c5", "value": 138986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917559, "uuid": "7b46eaf7-db92-4030-a914-f06852312c7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917559, "uuid": "a1e0769f-93c8-485f-b66c-e63b502dd16b", "value": "invoice-1645080830.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805a3ae1-117d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771936614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936614, "uuid": "813e1617-1904-4791-8e22-4adb570169a5", "comment": "Malware payload", "value": "52ea8cdca427b4b088fb0213b27d7a5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936614, "uuid": "927322c2-c943-4abb-b524-7e0327aeb538", "comment": "Malware payload", "value": "1cf18efac5c0fddc935dc7e588309c7d7fe4ca719dac9334420afc9ac8b45d4d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936614, "uuid": "5bf98888-68e1-4be7-8269-84e608b80db9", "comment": "Malware payload", "value": "d89ba521a3b3c2b026e3a1a7be222d31d40b3f95", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771936614, "uuid": "7365bae8-f3ff-4efc-ae43-d58ad74295a6", "comment": "Malware payload", "value": "2c06c6a231f93278db40f87bc1732d1513a80a298c7a95579712058e51327435b14932d57702926a56afb1f249a9c09d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936614, "uuid": "da21111f-ae60-4c4c-8278-8f661978f525", "value": "T19FF4291D21CDF704EA2C0B7AA5B24B28F27D9905248AE77F55F336E8540BF6D845C28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936614, "uuid": "658ad933-efbe-4501-a323-686f4dd4f5c9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936614, "uuid": "8a086d95-da9e-46db-b79c-819ded453674", "value": "12288:VT2bXx1iQdbS+F2jyOpR7e9pWyelMFRv5Mwu9kBMAbFQ1450qcw:VgD6L7e9PRRMpOMApe4aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771936614, "uuid": "b5823872-697c-46da-ba80-2b718e917974", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771936614, "uuid": "826f4c2f-8ad8-4df9-84e0-30a662d39dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771936614, "uuid": "844b3aef-2e57-4be4-ae61-bdffbbbfd036", "value": "Microsoft.Win32.TaskScheduler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfde0fb-114c-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1771915588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915588, "uuid": "5a732b7d-9473-4e13-a36d-03b3423a645e", "comment": "Malware payload (AmateraStealer)", "value": "e64dd0bba5abf4ccd0fbfa16ee2c55ba", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915588, "uuid": "99ae6af3-8f12-4433-b616-d7c208121507", "comment": "Malware payload (AmateraStealer)", "value": "1e6482e64cdd4bbe749f1726588f6755e6c84767cd8c09e2cb6f8cc8df16ff34", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915588, "uuid": "4cd839e2-464a-4d72-9994-b7ab9e076b29", "comment": "Malware payload (AmateraStealer)", "value": "c7a3eff00ac3e3cb06c242ae31cb781e8eae9c6c", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915588, "uuid": "9d84df6a-94d8-4166-8a6f-2e34f6f2610d", "comment": "Malware payload (AmateraStealer)", "value": "c9fc72c4fd33e555e29bc8f6ae1d1c1efa15e7c80d21b802de4c25e7d4202106761cf1585cdce4d02697626aed63eb9d", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915588, "uuid": "da33c081-6c36-4350-9253-3592b66122d9", "value": "T1A105B5A6008D2292CC5B307FA72CBF5CDADE64AD87518DAB4320DCEB394271BE970547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915588, "uuid": "12bf5818-822d-4874-b375-9c8df820fa40", "value": "6f2edc08c442fc9a0335eac62e71b526", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915588, "uuid": "bbcb37f2-95db-4037-b526-e2b09698d9d1", "value": "24576:zIdCdNDAbcG9b8ggXJIisp9chB7lbok0E:zdYbDBi+Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771915588, "uuid": "9ce8e0a3-e0e9-468c-b18e-86f607925294", "value": 828888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771915588, "uuid": "69d91d49-df7e-497f-9238-524fc402b207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915588, "uuid": "4f422cb6-54ad-4a34-b08f-378eb7bb9da2", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854b100d-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947360, "uuid": "db890e0a-25ee-41e6-87e6-734d180c30e6", "comment": "Malware payload (AgentTesla)", "value": "28e3ff0d2fababd395a1154be27b5292", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947360, "uuid": "288d92cf-9c8d-41e5-a5f6-4810ffb98321", "comment": "Malware payload (AgentTesla)", "value": "1ec6c306e2344f350cab5c3e34d7aa17437e35393f8bfeb09c034b8a412a6ba1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947360, "uuid": "a8d20397-110b-449d-bb66-277cca507e36", "comment": "Malware payload (AgentTesla)", "value": "afce4ba28358a2136821a5a2497a698d8f256f66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947360, "uuid": "2fcfa875-72a4-4454-9f3e-9efc5e7caad9", "comment": "Malware payload (AgentTesla)", "value": "b87fb9c21d6ee74fdeebe2be032bb6db794eb52f898756de9bf0bb973dff863ea0e4f8b1db7d895a08a703380b29fd62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947360, "uuid": "25729f80-272d-4048-a68d-5a340374ed31", "value": "T1DC2512186A17D807C55567358AF2F37027B88EDEE412E317AFEC6EEBB513B124C46182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947360, "uuid": "6cb1769f-4902-477d-97d5-d2f1ca76c6b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947360, "uuid": "b44a8b80-a119-422b-8cef-186fac228e7c", "value": "24576:dXjQbCYY8RA9PDZkv3PQz/mGxhA4Y6UhLnk79bOF:dXjxqRaivPQrmGJYzm9bOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947360, "uuid": "e61ad651-56fd-45a0-8646-ca7ef7270b91", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947360, "uuid": "d4d57dec-ba88-4061-8773-6b384a7a24bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947360, "uuid": "6206cf29-42a7-4b0a-95f2-cac2969d8498", "value": "0gnr2pYL5sTWEoK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a9a714-118d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771943280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943280, "uuid": "0e624892-2877-4cfb-ac28-7f40b5b5d776", "comment": "Malware payload (Formbook)", "value": "7bde48345744d0df86e55ddffe6682e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943280, "uuid": "8137c7ac-f885-4593-820c-265ae4ab29c6", "comment": "Malware payload (Formbook)", "value": "1ef388be81d3736c7f150e43658266540d0495b33c351dff18a328f5b8702039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943280, "uuid": "e6028387-99e3-47a3-b347-10369c6af789", "comment": "Malware payload (Formbook)", "value": "f1e7762a92e95bccb28c481bcd6374aef6cfbddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943280, "uuid": "979c5e1c-04cb-4696-9e27-3804ab4ad9ff", "comment": "Malware payload (Formbook)", "value": "358ad59da5eab521962796e7a55abdc497835f3b891e7ac602674f9ef17afde23c43c3cdd74c42dd41d994d21598dce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943280, "uuid": "ad7b4ccf-7999-4379-afca-c46c98e1d86d", "value": "T13F250298671AC817C16663358AF1F77413B84EDED512E7279FED6EFBB822B214C40182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943280, "uuid": "de8ff7f1-ec0e-42e7-a7ff-01176c4bc372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943280, "uuid": "7df38947-14d0-4694-a0a5-aa4e350d88c3", "value": "24576:exIjgRPYXlDUnk0LKuBGhedGiEkOWLLWIuB+BQv:eyj4PYVUhB0/LQLWIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943280, "uuid": "66d0337f-4802-4662-aa93-7903bfb77872", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943280, "uuid": "51de0973-fd44-44af-a0c1-489cd8998af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943280, "uuid": "38c90115-91f6-4df2-974d-c68e48be24e9", "value": "Shipping Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4609d807-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937805, "uuid": "448f00f7-ad55-4219-95b8-97cfe95ea356", "comment": "Malware payload", "value": "fb86b4a304b7aa754f06ce2cda5b89f5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937805, "uuid": "f7ace66f-bbfc-481b-8793-ee1f0b540096", "comment": "Malware payload", "value": "1fd25cfec4fb450be589d9e4ab8a2193a001c014484b212f427d34acd223e4b6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937805, "uuid": "b817643b-4888-47a3-b71a-133d863a8a29", "comment": "Malware payload", "value": "52843e9ee1455eb803f2530d58e1e9802c18d54d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937805, "uuid": "e0b30ae8-5549-4a2d-b641-4c5176af12be", "comment": "Malware payload", "value": "305b9590f395c7b8a062b43b3e7e7752be325734f1ce423321641444cccb9efc38fe23697ac6f25771e7612ef6cf03d9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937805, "uuid": "f6b65ec2-1219-42f4-b0f4-9a0bc77f6641", "value": "T1F031416661A021F4C353A72EFCCF5B45B09544FB010E256074BD8689BBB192CC7E71CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937805, "uuid": "7612a63f-eb8e-4dc4-ad01-ca888f86c91c", "value": "48:i47OPQSbHF/OQ/QhFL5AqkY/hXjkosemnkwhXS:VSButPJgXxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937805, "uuid": "0c2c3aa3-c8d8-4431-b14e-02e28ad25cad", "value": 1647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937805, "uuid": "6b671c01-dfbd-4528-b668-63e3e4d2c84e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937805, "uuid": "8d330ba0-74e6-4b9c-b157-081c239773c6", "value": "update-agent.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a718fb-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919282, "uuid": "40a27722-7322-44fc-b471-5aaed3359be0", "comment": "Malware payload", "value": "61a2c593947b82904dbf262cf227b3e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919282, "uuid": "1c5fdee3-d1f4-4701-b4e8-a978a29694cd", "comment": "Malware payload", "value": "2012273c82776145510a8d2c7bc8151ea523dc32804cf090b1462768999dea20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919282, "uuid": "76ada9cc-00f9-4510-a6b6-0243ef55c7bc", "comment": "Malware payload", "value": "3c15e4bee4908952c5bb84ffa698523f2f77b4ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919282, "uuid": "1995edc1-30e3-465f-89f5-bd13a1d9770e", "comment": "Malware payload", "value": "a5d8b36790b6bd15c98e9c8af4a54f90549b008d56b6a84a343c81b83d0a9a64609f146c55f6d6fdfe955a7204b7c29a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919282, "uuid": "b24cc463-87e7-40f3-91e4-435835ae06e9", "value": "T175D3C6559D2FADF39F89ADA2BAF04F95BEF25B670D2DD3AD240601F0009DA2352095C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919282, "uuid": "be93660c-79ba-496e-8bd5-e7199fcc8888", "value": "1536:CPXZ6uSEYoMMy5STvDxC8N7Wo7BrFA/n1tPr+lh0szAs4vvOFFpchuAzoU+MqYo7:CPXZ7YOrp+t4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919282, "uuid": "4c787317-1f0f-4fde-b515-78dc7c1704c7", "value": 138935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919282, "uuid": "1cd0cf13-b314-4e9c-9943-600942473494", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919282, "uuid": "cdea225d-8be6-400e-beb6-f38dad1f50b0", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae94643c-1197-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771947859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947859, "uuid": "01399a7d-275d-4ec1-9089-e4bd6de8ba4f", "comment": "Malware payload", "value": "3dace26e240bb43c9c0d6134802b59fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947859, "uuid": "5164adc8-26c3-4943-861a-91304b2f2ca8", "comment": "Malware payload", "value": "201ba6258cfa079e3daf4e90c089d25d1eecaf6f2bdf2b2575a7f81a9bad7d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947859, "uuid": "df3fe179-6e1a-46ec-8825-bf7a900743c3", "comment": "Malware payload", "value": "5ddee5763ace10ffa32bd697d04bb3843ecd3443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947859, "uuid": "8ec398d1-4906-4e27-9f86-4df587ff80d5", "comment": "Malware payload", "value": "6b2dfecbe5a9fb3d5036f8b750587789151f9efd3697468b0e4302777d1e7428ade9302f24fa528e18a2a50824e4470f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947859, "uuid": "2edbc58e-6a11-4e0a-9974-087fe648a769", "value": "T18782091FB65668ACC50EC37C89EA8733E07379252232372F1354C3725E95A649BBD58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947859, "uuid": "7f3ed036-2d5b-450e-b11e-3175929a6113", "value": "d5624c687807f216efa4143c8fc5789b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947859, "uuid": "7e145e09-0b76-40cd-97d5-5c392fd24862", "value": "384:sPZp2WkYOrqRIK9NR6bIsl3ll+XXX1BOe2K:AAWdOTdUcqnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947859, "uuid": "bd886a9e-bad6-493f-aeed-b5e9eae2c978", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947859, "uuid": "dce44056-a953-4453-9797-9431e8e71269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947859, "uuid": "b24ca393-049c-4133-b94b-9bd59df17c9a", "value": "xa0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45bf3b9-1158-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771920810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920810, "uuid": "1490896d-94a9-4183-90b2-e9fc672bff3c", "comment": "Malware payload", "value": "468175288625a0cf4ff0c3c453455e1d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920810, "uuid": "33873005-23c9-48a5-941d-5cc42b57a9e6", "comment": "Malware payload", "value": "2039e6366a6bcb8d7322764e5d4c42269134fb6aaee16884f182f628a04ca28a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920810, "uuid": "9cd6fead-3be3-469f-a8c2-7f340019ed41", "comment": "Malware payload", "value": "b6681b9bd752def7d1941e01ec806c5534d910c9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920810, "uuid": "cc8764d9-148a-4b60-aba8-15b96e610c2d", "comment": "Malware payload", "value": "f9c0b79b25c52d14aa5c8cef9ca3bf1aa20db3d7e6152b2539badaf04a62f3a659989ff23045a489553549d9eae9749e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920810, "uuid": "446242a7-98b6-4ed2-8487-953a503d5701", "value": "T1DAC58C31769FC126D66D02B2E92DEE4E953DBE730B7040D367E8399A58308C2573AB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920810, "uuid": "fb35dd88-db77-4c72-8bab-fc014e03bd53", "value": "49152:Av9HSnkxFozxoX/HZB/uFYBdSwug4h1GQu2SBc6h2Xgg8lW8r5YIqSGV5G:cSnqFozxY/XuFSu89r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920810, "uuid": "1f7729c9-a222-4b71-ad25-7c35e1ac9ea0", "value": 2555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920810, "uuid": "913ac483-2c85-408f-bd70-99a781c9e013", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920810, "uuid": "2931fb01-0e4a-4147-89b6-ae4c5322d04a", "value": "2039e6366a6bcb8d7322764e5d4c42269134fb6aaee16884f182f628a04ca28a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25850a84-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921429, "uuid": "f9bca90e-8c83-46ff-982f-87453392fc3a", "comment": "Malware payload", "value": "55a7b14656651b8cf348496a8003ae69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921429, "uuid": "acb539fd-8f8f-4729-86f1-d6359f5c0b88", "comment": "Malware payload", "value": "203cf0e3d88b6ee55100ae12ce3e07b06a6ebb6ef07756ddad93c10bbe73147c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921429, "uuid": "6ff27565-a1d6-4a9c-9234-0c4ae4de068f", "comment": "Malware payload", "value": "9319fcb377eb5705740dc9f4d1d58707ae043f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921429, "uuid": "93c106f9-aa28-4210-836c-ce41003d0f83", "comment": "Malware payload", "value": "8b045a7224b496e637f5945a23e67e944f2fc99d3dfd69eca5e89908a091f88b843c252c1f0aa8b5b83e6f0f9a013146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921429, "uuid": "8b7bd53a-cd6f-493f-b593-6aa52246daf1", "value": "T17D363950FACB44F6EA031E3144ABB27F67315D058B25DB87EA507F2AE9776D2083621C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921429, "uuid": "a3bcd46f-3944-48e9-be66-b5b05f09f4bf", "value": "49152:pYQhABz/zHgZCi0X+quHS+PRRf81XJzvk5hfpe6qiVF8n4tgP1ibRTPVnexcahhH:GBBSeX+quHSkREt4cxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921429, "uuid": "ae327395-bfb8-4967-b8a6-1ca3c38b5214", "value": 5128192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921429, "uuid": "f77cd00a-3a95-45a1-9be1-72a4433bd324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921429, "uuid": "02551c66-0af1-47e6-b178-39928010066d", "value": "386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba81074-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921493, "uuid": "467549d9-1beb-4cc3-9a8a-119105e539d7", "comment": "Malware payload", "value": "1f9f30a01c37cec4c1827009fc9c4c69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921493, "uuid": "21debbfe-a46b-44c4-b0f8-2e1efd481cbd", "comment": "Malware payload", "value": "2071c094cc9b712a5ef7252eaf714c3bfc12a453d1c1cd00ff38aa7b9a5d8851", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921493, "uuid": "17b6b52e-d506-4cc8-b7d0-8dd933389950", "comment": "Malware payload", "value": "8a79e90b7f42b62f605237db653708173ec722a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921493, "uuid": "0a403d67-6b86-4837-a8a2-b0ab6f85b9fd", "comment": "Malware payload", "value": "120a5c91dff5ba5a9085cbef9f7752b94140757a70f3b70d0f83a12118a6ea77c40a59cf051c5db851f5648af6b79981", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921493, "uuid": "380629ff-c911-4843-bf15-fcefd21b3fb2", "value": "T1BC362997B8924982C8E4367ABC7E81C473635EB99B9752576D04FE3C3BBE1990E34700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921493, "uuid": "316d31b4-1bde-407e-9438-d115267b723f", "value": "24576:F7FdM15FI+EsTLoF6EL/49tm77khuVryS3XOUPBkKgGethmaCOf87r7gAhazyhqG:F6522RdTlv3yw0z85m/gazYD+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921493, "uuid": "48577a1e-b076-44c8-8a7f-62eda2207b1e", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921493, "uuid": "74c284c5-a42b-421c-b79d-518d666f5a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921493, "uuid": "21d853f8-fe8d-401b-9d14-881bd84f5623", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3744f4c4-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950235, "uuid": "bcc8da85-8a9e-4a0c-8159-2fa3bbc6c28d", "comment": "Malware payload (Mirai)", "value": "6931106c29506e0388885ca199a27ffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950235, "uuid": "a21576ac-d533-4357-a413-f66c64b33008", "comment": "Malware payload (Mirai)", "value": "20b3bd5674be163ead915f6c5fc37bb920fb0ac5cbc9ca5f8c7e3c0fd65b1ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950235, "uuid": "8005d6a6-eedc-4214-89df-44d5f1b57f92", "comment": "Malware payload (Mirai)", "value": "048537bfacd74f34f513e2c859718237ed1dcc28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950235, "uuid": "488322fd-6621-46b4-b003-0c200979c7e5", "comment": "Malware payload (Mirai)", "value": "ea5b08aa54154ffa697fd0ef8cf19bb13ecc319b586d0489c4bb298c344d24de04ebc883a09f216163b3bc912034afe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950235, "uuid": "0d90bdef-3191-4cac-ade5-38e70269d879", "value": "T125F36C07B4C190FDC8D9C2B48FAEE126D972F45D2138B21F27D47E262E5EE202B5E651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950235, "uuid": "ce3fa742-aef3-4268-a80d-f554696496c3", "value": "3072:7mw+Dhezejtvns3VZpufhIJrzPJl3LSp4MYB8I5:B3tvR3MPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950235, "uuid": "77cbbb3a-0fec-4330-b911-c759296e0516", "value": 165832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950235, "uuid": "fa089692-c451-4dd5-9059-d304ca567ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950235, "uuid": "7c7f2998-82dd-4748-bdfb-f3217e707394", "value": "netstat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84607067-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960673, "uuid": "aa8206e7-7924-4458-88d5-87e39802d30a", "comment": "Malware payload", "value": "928efb7146106c9e7a97c3705f029a76", "object_relation": "md5", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960673, "uuid": "02f3b39a-1244-47d9-85cf-e4493e631b9e", "comment": "Malware payload", "value": "22db79be5ebad3ec174ef07cbc2782b90389afc3d088dbd87ce25595b2941eb1", "object_relation": "sha256", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960673, "uuid": "a874641b-13c9-47be-98ee-2068dbd2f1e1", "comment": "Malware payload", "value": "1de6096adbf838f08cde9746217ce1ae4cb33d1f", "object_relation": "sha1", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960673, "uuid": "25222e7f-52f3-4bed-a790-870e4e6a75d6", "comment": "Malware payload", "value": "9358da277dbe7c90aaec07a26761191def83b5a1672f813ba733e453ffae5e6aaa6e8598ba993075a8b8cb6bfd5465dd", "object_relation": "sha3-384", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960673, "uuid": "d6d66a9e-aba0-4c6d-8cc8-7f52bcd50d87", "value": "T130258EDBB0B0D321FD56E7390AD5328E7B1214E377A9DC071AD087A62A381E3971953B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960673, "uuid": "db09d399-3c3a-45e4-b464-5737a48abbb5", "value": "cf9a27d5325881e8639ada4e0b06ce16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960673, "uuid": "bbc3375b-b007-4b81-b098-4f97dd27acbf", "value": "12288:uFHHM/1ibTagHRRTvgM/CjLIR04cesVnvuQaPUvNbT4gehmw4ipP/uNUj7NhKX:u1Hb97Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960673, "uuid": "c2b7b24c-49d8-4a8f-9e75-92628394923a", "value": 1030424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960673, "uuid": "c3fbda5c-8ec2-49c7-b77e-8f4a3b864bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960673, "uuid": "bdff519c-a1e2-4182-936e-0156bf8a40c5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b752f9-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919368, "uuid": "0063a846-801d-4562-9c51-aa3ae077318a", "comment": "Malware payload", "value": "09d7ed8dbc3a41207bbe1ac6b9f7095d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919368, "uuid": "9316ade8-3181-4186-91a3-c6ab4baa355c", "comment": "Malware payload", "value": "237035313cdff9444623e08feb57a534cc8a62b8956d96429ffb4ef90a4d509c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919368, "uuid": "0333a8c6-bb06-49af-85db-abb7efb9a0a6", "comment": "Malware payload", "value": "9cc4258ebbad395bf6855111c69b3ad9b0b57e2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919368, "uuid": "066df45c-1408-472d-b1a9-ec9d43683863", "comment": "Malware payload", "value": "f63e52bac3aea9eb4281700d8af292edbd31eec48d984f3d26ce58154383531499b2ff7559a979bcca5dfe29f918f284", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919368, "uuid": "5b633b53-b9bc-4ba7-b00e-807d996e564b", "value": "T10FD319AAEFBA568C18DDECCC46FD10DC6F116B9542F2E74F24ED08284B3E046499D267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919368, "uuid": "b00a0bfa-72d3-4a05-a627-8f3555dbfddb", "value": "1536:CPXZ6uSEY9DkBpaFwiofrs/us54YHXDYFoA:CPXZ7YOpaL4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919368, "uuid": "99be29cd-b89a-422c-af78-88446b5fd1c7", "value": 137959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919368, "uuid": "9b94dd9e-7585-49e7-9ac1-a45beb1b5e83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919368, "uuid": "310ecf37-fbad-42a2-a7a8-f620a4e84f33", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb47dac-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917417, "uuid": "dfa75155-8963-4112-8826-ee75cc2049ce", "comment": "Malware payload", "value": "f2f0855b10de72fa12983e97927ff5d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917417, "uuid": "43bafd08-1b92-4843-ac33-5f3c7cbbfc61", "comment": "Malware payload", "value": "237ceb3b5bcf36c7b40c4f21e2d94f229c3608e9e6677e729de761cc2fb6eabc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917417, "uuid": "a60b9f2e-4465-4aad-b601-40386b21fdda", "comment": "Malware payload", "value": "150f72efaceac18599be3f071a3c660290661b48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917417, "uuid": "018e5de2-c15a-4e1b-885b-b5786535cc51", "comment": "Malware payload", "value": "f9bc344782214e4f27e7129fceeaef6bd1c7ccb7a13ced6e8324deefea2a3f10327b88b1555afea81d646d156bfa8dbe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917417, "uuid": "868b647b-407f-4819-8642-e10373c6e2b9", "value": "T14ED3D7836DA370131896787F3F6BC5AEE047DAAE25F453E0944F2548BFA4B002D664F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917417, "uuid": "47cee803-7c2c-4956-8e0a-f6879368cb2f", "value": "768:C8m/Z6sZjWsYuSwnckNuRY+Kp/Fx3vj3N03gi3A3XxeLScFYHXwz04mYF6F2r:CPXZ6uSEYY1p/FtrNIgqUX4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917417, "uuid": "73dbbb84-d9b8-41a5-92fa-d467613ca935", "value": 137989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917417, "uuid": "7ca2a73e-0e7e-47eb-86bf-4ab36daa171b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917417, "uuid": "cacaffa9-db19-48bf-9e66-6cd02581ae8d", "value": "invoice-1645080830.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a6cbf3-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917453, "uuid": "adccf709-c754-46b7-a87f-16b8ab29225a", "comment": "Malware payload", "value": "bc35cd28286cfd760cb4eab5c37b1aa4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917453, "uuid": "e566be95-8c26-4063-ad0c-ff54600f0bda", "comment": "Malware payload", "value": "2441a14600f71b2d1572d13435a6a6345e474b45d660b761caf236b8121ccc02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917453, "uuid": "b1c701eb-0fbe-444e-8398-e4136c3b66fa", "comment": "Malware payload", "value": "c87658ab57d2e61ab6591e92b3ca6d215324c97f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917453, "uuid": "a89d6294-db69-4324-b656-e0a544113513", "comment": "Malware payload", "value": "c1a4978784df2eb9b0e12f5cf0035a1daefba002e19c76b254e7b231616fbdd79c29deebbb1c307cb63863ff17e2db37", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917453, "uuid": "e7121e5b-7e4f-4a35-a6d0-b3387d2e5802", "value": "T106D30BA0A8C9BC29AC114F6DBF7C79705CC1648B8B8316D5CC5B3E6BD5A111FAC2DB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917453, "uuid": "40fe5dc0-8cbc-47b0-b95a-0b2d73e266bc", "value": "768:C8m/Z6sZjWsYuSwnckNuRj2N32N02N32Nq2NA2ND2Nw2Ns2N52Ng2Nx2NC2Ns2Nd:CPXZ6uSEY7Fapp4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917453, "uuid": "3bc04e16-d897-4caf-8124-76ddb7e04eeb", "value": 137059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917453, "uuid": "72293c70-6fd5-45b8-a87d-4435e11f5c34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917453, "uuid": "83d5b4f1-24a8-431a-a4ff-5d9d803a23be", "value": "invoice-1645080830.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0031a05-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771957337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957337, "uuid": "4acd1d07-195b-480f-9fc5-f4d9436ab102", "comment": "Malware payload", "value": "8062b2c82b95272ba6f258a6da47fef7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957337, "uuid": "37f7d40d-3195-4c18-82b6-1079ae2179b2", "comment": "Malware payload", "value": "2441a719625d2b372061589600d21c8b114f9134b259f5ebebad46df392f5d44", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957337, "uuid": "0ce72d47-14cb-44bf-ae0a-b6dff1f84f13", "comment": "Malware payload", "value": "16f7a5b8ef909da1e552ee71475d6389f4b6c443", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957337, "uuid": "1e3417ab-3f76-4ae6-9c5d-3db5d35fd543", "comment": "Malware payload", "value": "90909fd55e0a8bf5a5ef9f5bef3c28a661ca99f3ae191c0ea511bb9133c093c9ad22b05e1ba25e5b624e5eb77443daba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957337, "uuid": "bf4b7200-449e-43d2-ad1b-6e6a66f2eade", "value": "T1E8A12A74CA9E2CC4C901C1BC3ADA646F588CA5B807B03772872A9BCC78C4B5309F01D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957337, "uuid": "20fedc8f-149d-49ae-8465-1c779bb775b4", "value": "96:riAIyCCHVFH4jl+cmtc6LfkBYJDD1v5kW1EItQ3+llQ:EI4jbWaYph5WItQula", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957337, "uuid": "e6579a8b-c963-4b7a-aefd-c3f88c15d294", "value": 4839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957337, "uuid": "ca2e5597-9035-4002-b7cd-2155b7f8dc95", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957337, "uuid": "f7b568e1-3f23-4e3d-8135-ed10850e11e6", "value": "result.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacc62e5-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928954, "uuid": "86d9cd1e-a5bb-482e-a083-3f74ffa93948", "comment": "Malware payload (Mirai)", "value": "e49aec1d214b206b86dd5bf851eea356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928954, "uuid": "c71b54d1-eed0-4d01-acc9-336c549c6d2f", "comment": "Malware payload (Mirai)", "value": "250fa7449ae94117d057ec0340ab0cbd2e29622fe0bb84a6da3e3f3521b890ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928954, "uuid": "452266d4-a883-4393-80b0-651cbb3b2c9e", "comment": "Malware payload (Mirai)", "value": "83dcec50063056b9dbc034b2fcb73755b4fd6f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928954, "uuid": "3bf4078e-34e2-4f53-ab17-1fddce470349", "comment": "Malware payload (Mirai)", "value": "8aa37453f6884889b50be2f583b47ad251ee2db1115893cb93d5ac7ec42477b08c9bd4cd1958ca3be9f52c36b88b63c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928954, "uuid": "9710527f-7577-4766-97c7-d9050b0c0836", "value": "T120F33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928954, "uuid": "038cf145-1be1-42a0-a9e0-c9993450642a", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6MjZHDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6OZHDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928954, "uuid": "effe208d-2cd8-463c-9247-124bb1bcc27a", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928954, "uuid": "05079f91-6457-45e8-87da-3dbe07e05dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928954, "uuid": "fd163d2f-4510-434b-b35d-daa27d0217f8", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd24879-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939160, "uuid": "1ef60d22-10d0-4d8c-97b1-0122fcf9171c", "comment": "Malware payload (Mirai)", "value": "8679d9104521d51358f8992ad718fbb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939160, "uuid": "706de1a4-9e5b-4824-8c77-abf272b4d430", "comment": "Malware payload (Mirai)", "value": "2532c1cde9bdcea2ab0dee48a8786619f46a06eada9e279ca3fb66a8b0e40577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939160, "uuid": "066dacbb-78ad-4f51-869e-346f84f92b93", "comment": "Malware payload (Mirai)", "value": "b39dacb16a09e9675129cd67605015077e7fdf47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939160, "uuid": "709bf1cd-e67c-42c1-a5cc-ee76b60475d1", "comment": "Malware payload (Mirai)", "value": "811310d2c193914f190d79a0655019025745fa1d2438568670b4e5501f311a1878834f006470c0a8832556d2b5447c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939160, "uuid": "e7d78ece-d669-4150-b98b-7e6a2bf8c1c6", "value": "T1BEC3AE73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939160, "uuid": "184a0d3a-34bb-40bb-b548-a3b8abe4bd33", "value": "3072:hfpZykqkt436I+9eIHPmNOkSMPXeC4GnHg:hRZ0F3Bc+NOkvZhnHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939160, "uuid": "f373a809-a5c2-47da-ba86-b249efcb7cf5", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939160, "uuid": "88a6246d-9f65-4352-b360-9900d8f536f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939160, "uuid": "4c054d7f-3101-4111-a82e-122a10a9e84d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b46180-118f-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1771944218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944218, "uuid": "9e3ec952-c77f-4833-84e8-af9e0218bfe6", "comment": "Malware payload (Loki)", "value": "f6c255bffe3253d538fca1adbb0ccc60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944218, "uuid": "5dbcc395-05ff-45fd-b25a-76740fbbe3a4", "comment": "Malware payload (Loki)", "value": "25e9013b961f8e4e49f65f9f29a08094929adf98c034a4536c871ab576ab5ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944218, "uuid": "68105da5-7ca8-4acc-9458-f5d0592b0517", "comment": "Malware payload (Loki)", "value": "2919235d611bb36611c1c47d53b52521b90d3a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944218, "uuid": "d2e0836e-146f-4b4a-a52a-a3bff1b3b850", "comment": "Malware payload (Loki)", "value": "cf3c2262a3e1f3e28d76da1bb462412f21442c22d94e938acef7fe8fc8b6eb730cb9505d966bac5fd6f3f140315ba910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944218, "uuid": "0628cbc4-ad07-4836-9f77-8f6d0943448b", "value": "T1A6F402986B06C903C86A5B385775F27427BC1DEAE811D3074FECEDE7B966F255C08282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944218, "uuid": "d6a12218-da11-4448-8562-e5e06b3961ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944218, "uuid": "3fd2919b-f76b-48b2-b3bc-d1147697f9cd", "value": "24576:4z/Tq26QSS2pLoeX7nGY1xBaZsQwuK8XIjaKw:ueLDHnBles1uNIja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771944218, "uuid": "c6ea540c-e4d4-47f6-b857-a92aef0a577e", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771944218, "uuid": "1d3dbcfd-0471-4117-978c-caf5b91992c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944218, "uuid": "625d068f-0238-4b32-be01-407e37196c70", "value": "DOCUMENT3.bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac18ed4-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917465, "uuid": "f52992dc-7b83-4c23-a5fc-e065719d6e31", "comment": "Malware payload", "value": "d76010d4a99743896f01c319410e7d4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917465, "uuid": "cc3249a9-2e66-4d05-8f8b-24b691aa8ba3", "comment": "Malware payload", "value": "2699e0348095b3668802d882dd5e0ab77c0bbaacbb0b4ca10d33b67ef0b03f68", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917465, "uuid": "d8498c1b-dc50-4499-be66-bed197404efe", "comment": "Malware payload", "value": "70e81a0e1590d47055db74d50f72ed7694d1a7b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917465, "uuid": "a1206833-39cf-48b8-96d6-6884e2f240fa", "comment": "Malware payload", "value": "29854ec9ef1fc2b67dcdcb9cc3e089a714e5bae3cbcde357d50087056cd27be644dcd6e64479a86655551f091cbd8b93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917465, "uuid": "0f4ef391-a966-41db-938f-1aa517f905ce", "value": "T1C1D3EA583B08EEF15E1F22319EE660C705ABB6094E7C89C8545C8E25B69EF26F075CF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917465, "uuid": "988ef65b-a890-4812-ba21-7ffedc5faf3d", "value": "768:C8m/Z6sZjWsYuSwnckNuR2vFzdGOe0pdDxeLScFYHXwz04mYF6F2r:CPXZ6uSEYsFlpV4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917465, "uuid": "69337ce6-2145-4b4b-956d-20f45a685e0d", "value": 138948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917465, "uuid": "e3ffb2bc-3176-4d1b-88f4-35f44c28a726", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917465, "uuid": "e666189a-f714-4594-9495-9fb010e9a0a0", "value": "invoice-1645080830.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86602d40-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939201, "uuid": "cffb83ac-83f2-4237-b56f-f1cc725a5cd4", "comment": "Malware payload (Mirai)", "value": "fcddf95324c5448861a1b515f9f42a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939201, "uuid": "46f0ea30-0770-48c7-8dce-18cce8052e03", "comment": "Malware payload (Mirai)", "value": "2716b9112df966f9c4eb780a8b781cf008a52c5464d92fb45a13d181c6572fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939201, "uuid": "0234518f-1a53-47c0-9497-c3eac7e11b48", "comment": "Malware payload (Mirai)", "value": "0b44abead623fb35956a97ca1c65c11fed9954b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939201, "uuid": "25f4e931-97cd-41f0-84a8-165b2c3bb45b", "comment": "Malware payload (Mirai)", "value": "48d10c2d376dc8675edcbe62ddf414ed47318aeb06cea37b64d4e6628f1a503bdc4f0c5441acd47161ae1324352977c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939201, "uuid": "d1d5a135-76bd-4982-ad5d-f330747b2dec", "value": "T115B339C0AA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939201, "uuid": "3a2784af-136e-46a6-98b8-934b1c01ab75", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhgohHw0pJbLb:XFmzY5mXBypzjYYZ/5+JdlHLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939201, "uuid": "98f39c69-78ef-4139-a947-740bb7fc56d6", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939201, "uuid": "1e61dce9-3dd5-4468-bd5d-33c822d55d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939201, "uuid": "0fc3ab28-e4e9-4d85-9903-33883aa29692", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a809a0-1177-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771933997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771933997, "uuid": "8cdd0977-ee37-41f4-94eb-d736875687ac", "comment": "Malware payload (Mirai)", "value": "40d9e65b9a3ebf5ac1d033a6616c89f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771933997, "uuid": "44c9841c-9a24-4e80-8b9a-7c534a24beb3", "comment": "Malware payload (Mirai)", "value": "289f26b8ca59150d5825a8a3cb81cccb35906a12122198866a4f0466d0630e82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771933997, "uuid": "09d10621-f6dc-400d-93d9-32726d054d6b", "comment": "Malware payload (Mirai)", "value": "719829dc6c517e336a706d9a8fad4c219e3f1b69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771933997, "uuid": "eafaf6a0-f2d0-43b3-8877-15e1bcae05b1", "comment": "Malware payload (Mirai)", "value": "f65a4c9ad1fd3ab366b3d1bd933f869bacbc64ec6d324a6b173d9ebbe2610518dde95fb7d68a816c6f7d92b3546ae903", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771933997, "uuid": "bbba456e-ceb0-4f28-a0c1-bc3d8a2c7540", "value": "T19F31B5CE30415BB3298D9F40F2E19158B48089D266B91F74FDB918A6CFD760537ACAF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771933997, "uuid": "243e9422-8f9a-40ea-92d2-14b639716450", "value": "24:nDdJfDxSXdkOJsO8dxqDad1hydae6gdTLWRdRxRdhHp/t6dlzljJdbBhAdOel8NI:nDkQIaAMtgV6NRibpA51JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771933997, "uuid": "fe396bec-e608-4622-9123-af18cdab8014", "value": 1732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771933997, "uuid": "f333f355-5e0c-4cbf-a0bd-dc0b269fb8c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771933997, "uuid": "6a2af38e-1f46-4a8e-8c24-3f6b1d977ced", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a99ea0e-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (GoProxy)", "timestamp": 1771921975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921975, "uuid": "7a1646b6-02a7-4918-88b8-7baebe929b17", "comment": "Malware payload (GoProxy)", "value": "84a537e811238d23277776a22a3e9640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921975, "uuid": "8cce9bae-0d88-4e9f-b38e-5f214b8fa7c4", "comment": "Malware payload (GoProxy)", "value": "29d6f962aada496eb5c6c7ceef66648a18a83072894b25bc62c99f92de315b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921975, "uuid": "7193c97a-b0ef-4e9b-9960-7b0132322634", "comment": "Malware payload (GoProxy)", "value": "ed10c5007415f42ee1fde7c87f483f029f00f803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921975, "uuid": "7d35d3c2-8c83-4d83-afb2-78f01a96c8bd", "comment": "Malware payload (GoProxy)", "value": "d832e191da392a18a9dff8908b544bc1c610e8b53be2fec800287ac1e6c67e638e8b05bbd20c373264b6d6b166028269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921975, "uuid": "1175af6d-373a-447e-a8b6-b1f5d4817dd6", "value": "T12E664B03ECA555E4C0A9E2318A679152FBB17C495B3523D72BA0F7382F72BD0AE78750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921975, "uuid": "f75ace8d-a6db-4719-88a8-421f00fb3dcc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921975, "uuid": "90516274-d14e-4088-b151-0d5a32e11a7d", "value": "49152:4/i/8kscDBLemUve/7SUA+1eo5Q4MtynLX4kKLr139iFZ+EjUBP9sqSYfKiK9Kvk:4CIs5AL4hLXhU+CiWb13TdEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921975, "uuid": "9444bffe-5f73-406b-90f8-7fcf6e25d220", "value": 6575864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921975, "uuid": "73f32d76-c580-467a-81ce-460bdad4d79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921975, "uuid": "a6178bc9-9826-41d3-8b56-c13f60c10698", "value": "Payload (11)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04005ce-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937634, "uuid": "c6a6c881-f7f9-4082-9b18-3a49f36de05d", "comment": "Malware payload (Mirai)", "value": "7e4401eb4f729f1f1f927eafd72be3b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937634, "uuid": "a76dc944-cd7d-46ff-ac33-9f04d8b37e21", "comment": "Malware payload (Mirai)", "value": "2a1023eb41f3d500b171a70c020d4a3cc5c51ab71a1fd95081fdf609bc5f42f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937634, "uuid": "e26166f5-75e7-4c64-9903-121551bc2882", "comment": "Malware payload (Mirai)", "value": "aa36e6745335fe4281f7642f01a0873e23b2c667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937634, "uuid": "27b4298b-761f-4892-b50d-6f8ba703d9d3", "comment": "Malware payload (Mirai)", "value": "5cbbff967ac2bd4f54ff9feaa9ec817db0797ff38dff8c5500f506f79fea412488dc698b466c3be09063336a6507a4cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937634, "uuid": "89eb44f7-8923-4a4f-a1c8-d75e9f11d13a", "value": "T127056C5DFE4F7D47D2C6E239DB4AC3A47227B099D223105332C1024DE6C9DED8BA2999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937634, "uuid": "2ea63beb-061b-47d1-99f8-31746f2bdd68", "value": "12288:YGus54bZvQPV7UH2jN/jBjaLwBqDYza5oPDI+XiJooJOhcF:Ju/vU3/djtBqcJI9Joxhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937634, "uuid": "59113639-0e05-466b-b886-286ef6ebf515", "value": 872680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937634, "uuid": "a6a73df1-8030-484a-91ba-3904baa7d0c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937634, "uuid": "331fe448-b9f5-479e-a9e3-d7563ff6b2cc", "value": "a2work_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cadf38-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917677, "uuid": "5467316f-758b-4a6b-afe4-cf7ca069f49f", "comment": "Malware payload", "value": "cd405fafc3778f95bb7ca495184dda96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917677, "uuid": "ce6d7242-95e7-457d-b942-e8281cf260cc", "comment": "Malware payload", "value": "2aa01941339edbc22fab2ca1d80b9290ae9bbfc9c9e09d0bc7de350ee80efbfb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917677, "uuid": "d22efebc-3361-496d-a4a4-dcc6b94af73d", "comment": "Malware payload", "value": "93493f5c1b945ab228bf190c05d4baefaae5cead", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917677, "uuid": "ae74424a-7960-41de-8dae-dec89d3b5685", "comment": "Malware payload", "value": "f4133cb3650942c24c2a3cb4421cbc8c4a2faa9939a17a39371931e3c81f3ceb2ac5ce0dc98b2c2b3ac05dab0357d8ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917677, "uuid": "faa374d6-1f66-4383-8909-0f5b6ebf908a", "value": "T1CAD30B19AA6E642F7913EDA0BC877D0A19F02CB09C3CA03D1550D9758FD5BCB26B3E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917677, "uuid": "0e02e932-5f70-4c8f-8031-9baa3cbb04b4", "value": "3072:CPXZ7Yy2vFznyDG+dyw/MCvBq2csXIsYmn0wpV9/TbOu/9pDXlh8OzhrrH3zH2WO:E9pDPX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917677, "uuid": "24a8a062-f6c4-46af-9619-7d41ab0f29f8", "value": 138017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917677, "uuid": "6455104b-550e-4453-886b-8006ec38fb85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917677, "uuid": "ecd31ee8-3f68-4199-8513-18b60b596868", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc3dbf-114f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916689, "uuid": "670801c0-813e-4781-ad78-9cc9c8e93f80", "comment": "Malware payload", "value": "db1ed1885f8d076f405b89a2b02dc08d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916689, "uuid": "81166509-86e1-49d7-b3c7-3f0e98b3d79e", "comment": "Malware payload", "value": "2b925f4f402006eab07b1d6275c70148450099aac262adafe9757f6d52d71ff8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916689, "uuid": "754d4f59-5f3d-4289-b260-6f3d95b0c8f8", "comment": "Malware payload", "value": "299c34e72555bd647812ec29e53977bc84b5b6a7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916689, "uuid": "e04113de-c1a0-4742-b3a2-99f764fed9cd", "comment": "Malware payload", "value": "5f6db5a67cb061d228934f78682676e863bc008c057563effef42fac91303a7afc969497f4447170a1b78e4954b9d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916689, "uuid": "8b78d960-f7f0-4f83-bb3c-179fcdabb34d", "value": "T18AD2E178CCA54431C49CDA5B05A30DD2B2CC009E3295AB976C9DA0B70D972A7F4B66FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916689, "uuid": "e274aed1-e628-4bb5-a09b-b4de8735528c", "value": "768:idi8rDa+a8gXoXYQR2+dsiXzczBEQH6fBCQuCXvpr:SK8g4Xf2Ysk6EKyBnfpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916689, "uuid": "39c63ae7-3261-4e2a-8a94-edad33059f2c", "value": 30660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916689, "uuid": "c4d81cff-c0bf-42de-a702-1bbf9fba1f7f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916689, "uuid": "55aa16aa-6fb5-4093-8e7b-d2a60fbc093c", "value": "Documento#6124.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b077a4fc-11a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771953016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953016, "uuid": "8844431d-d44e-4b91-896c-23c1f855ab3f", "comment": "Malware payload", "value": "e0d883fa1a601b2fd7b08ba300d7e6f8", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953016, "uuid": "0527e1d7-0850-4633-90de-329e4a185592", "comment": "Malware payload", "value": "2bbcbc88d04615079fa17708c62f07ccb138c19bb9ed78ae43f9172cd91931ba", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953016, "uuid": "534890f7-d4ad-484d-8637-6ba98a43e0df", "comment": "Malware payload", "value": "419aaddb4740de5ae83b3bd1af1e7703ac147666", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953016, "uuid": "7f87de6f-aac3-475c-830f-d1ceebc9ca76", "comment": "Malware payload", "value": "9596453b766b872e40a5804e556629da2843f4d775641abfdeaf04ca72f3de63c4abebaa4bc8265e5a22333137977fd3", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953016, "uuid": "78c10c81-4932-47b5-a5cf-7493e2945956", "value": "T1D0E47DA8665C2AB533472D569C67FBC62370DB37B761AE7CC0355381805A3E49BE2C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953016, "uuid": "be9f7e0f-478e-473a-aa2e-fb5eb95017d0", "value": "12288:Gj1UF1a/49mx9hqnuXdlw0ihTVo8LKpJejfzfJB1b+:Go0/iugv5XLKpkf7JvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771953016, "uuid": "b4b664e3-c3ae-4334-b379-e04079c4252d", "value": 672755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771953016, "uuid": "e136ed33-032b-451e-b91d-a12329beb7df", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953016, "uuid": "229ed02f-d3e2-4bf7-ad21-d2c6b8b396fb", "value": "\u0410\u041a\u0422 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ee7dd2-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1771960855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960855, "uuid": "9a20a89e-61df-4123-9dce-d7b8ba5a32f1", "comment": "Malware payload (Smoke Loader)", "value": "84cb851c2a2bb773f93d5a0218b919ba", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7352", "colour": "#0CF5F2", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960855, "uuid": "e98793e3-091e-4d15-a98d-1b8f0127a622", "comment": "Malware payload (Smoke Loader)", "value": "2be484000259ea262929de41c83e6f574d7b9b7d9fac7a2817a938e79df53608", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7352", "colour": "#0CF5F2", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960855, "uuid": "935e1d11-24c7-49d1-a7d6-ad27cd0b0e8e", "comment": "Malware payload (Smoke Loader)", "value": "be4efcb11c961419fad75456590c1f84a657f8fc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7352", "colour": "#0CF5F2", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960855, "uuid": "ab96e1e8-3c2e-4ee7-aa7a-d6a8c963c0c0", "comment": "Malware payload (Smoke Loader)", "value": "0899a8c5f808be20a5889cfa2eae169693264bfd29b327547d3b50e1b04349149a5f9fd1988bcafcb89b0120a18e4836", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7352", "colour": "#0CF5F2", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960855, "uuid": "e42f79c8-7da7-4722-a0ed-97b00a1dbd4f", "value": "T1A4E633347785F44BE7304B21244CE8A95742CF0A0C8F96D8BF25F9AADB311B7498D9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960855, "uuid": "8cc08b66-3254-4740-b6f9-df461d3a232b", "value": "393216:+CkNHl9sZqeiWfgS/X00QezwnYChkGPI3:zkJlvWNP/aNjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960855, "uuid": "eb43b0e1-fd0b-4b44-9e63-c3174b63a671", "value": 14537603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960855, "uuid": "b74dd049-529d-4da1-b32b-a8005bfe17c7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960855, "uuid": "f2e2d3a8-4549-4bba-9aa6-b03e1b835779", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2306c1da-1125-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771898662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898662, "uuid": "399b9de2-c839-41c9-8c31-24ecaa2f57cd", "comment": "Malware payload (Mirai)", "value": "2dc026dc3bb33b566d633270db1d0425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898662, "uuid": "6e99d779-4776-41ad-ae3e-fc095a6fb03f", "comment": "Malware payload (Mirai)", "value": "2c3a7ce119f17ad7f50576f6474135599012e21464403901d1a80e1fef1f2d2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898662, "uuid": "ed510e75-6c73-4655-a1ad-23260f4569cd", "comment": "Malware payload (Mirai)", "value": "cdedfc80da66001437ab92455a7fb12271acb979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898662, "uuid": "a4532373-2c2e-476c-a7f6-09d412b76030", "comment": "Malware payload (Mirai)", "value": "112d6415d67d5fdb969c89567480afe6861ef0362b963e5c47839a0b7f360e3192ce54f7071667a0039b2eb519aa9121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898662, "uuid": "70f7891a-9959-4c45-ab5e-5caca470e627", "value": "T113735AC5B643D0F4E8160471217BFB375B32F1B90129DA43E7A99A73EC62602E917B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898662, "uuid": "b1330173-a8a9-464b-bdbc-d61ab3396e3e", "value": "1536:abyW1FJ5BN8mDAGpS+KsGuPcLpKOBgdH5QEAUyzv3uBTxYdomaHrxZISgT:abyW1FJ5BymDAG1KLu0mByzv3wYKvL+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771898662, "uuid": "430ba28e-dae5-4c8b-ab63-4a2e446f0759", "value": 79984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771898662, "uuid": "f170efb2-9074-47aa-867c-80045b631fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898662, "uuid": "88becfcf-b4f1-4a45-afd8-cff684b559f1", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0584c3-11b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960228, "uuid": "0f0520b7-5799-4189-9f1a-049979d18f26", "comment": "Malware payload", "value": "b3cb8b4057f7c1c31379068a7640870a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960228, "uuid": "98f37558-f400-4da1-947e-641eace3cf18", "comment": "Malware payload", "value": "2c6aa42aefc781c8f9d5f750049b46dea3649e3034e5e09f431b642d959fa797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960228, "uuid": "1cd6fe9b-b0e3-430c-a334-76efda1ad26d", "comment": "Malware payload", "value": "d6fc4dd831ea86a0577f75e723bb46646bab2533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960228, "uuid": "4a802ca0-efa5-4734-8b7b-9dda9a458d5b", "comment": "Malware payload", "value": "c337bed5f29b2f94a5c4f36b9be615ce8d667a6c1663c8c8e76c1afb852b1e0b9670d230fa1d61671c930e63323876a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960228, "uuid": "8a8219a1-5fb8-4d65-8728-4bbb0e2ba41f", "value": "T1B7E633353F553F8AC6926D77AA41F075363A8E20995BF366F2C9B3ED406A4269FC1C00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960228, "uuid": "e6bcfcda-16db-4ac7-9b9f-094e43fe31ce", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960228, "uuid": "6373961d-a0c8-4a74-849e-324cd97fe58a", "value": "196608:hx0XqNV6ZuOuh8EY9rgGgNBX1eVhFsRkkbLSDeELoAGLUUctTPrT7GwthFPKKy2b:hAqM+YruXX2hq5bLSyZdctTPrTSCh0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960228, "uuid": "b6c4bba0-8fff-4715-a361-2a6b735e877e", "value": 14518784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960228, "uuid": "8979149a-a4ca-44a6-a9be-cc7e4718e4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960228, "uuid": "4f2e7d15-90cc-4e08-919c-a82feff48833", "value": "Installer_v5528_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddfe3c0-11a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771953387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953387, "uuid": "e3ba4907-5c22-4477-a946-2b7c71e3ecb7", "comment": "Malware payload", "value": "ad248bdc7e04f0f0dd16d48c7bdbe3f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953387, "uuid": "bcd3ca69-2d2c-4dac-9a8f-91bdbe1aaa40", "comment": "Malware payload", "value": "2d999cab5d169a20247cabb5e269df33e4a6d47f0a52a284430fd86ccd637620", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953387, "uuid": "f7ca0f8a-3c09-459b-a061-8cdab1a06ead", "comment": "Malware payload", "value": "1387cd606ed4c06bbd1037bb7102dde0f6f894c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953387, "uuid": "91174abc-504e-470d-aa99-c1c2682c4d81", "comment": "Malware payload", "value": "3b3941cec663de3d09497c2543ae5d7e31e4cb692d9f39e5a4ba9152412e6aed59f720f6f1128b816d8c59b41ba94e32", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953387, "uuid": "66e0b284-3c0b-4ec8-ab04-a442bc03418a", "value": "T1BDA2E14247938D62D2775A33086CE882B4BC4FE7D59E1063F0DBE9475E3EB882C95384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953387, "uuid": "6b83ea78-163a-4d56-b9a0-aaffbca54097", "value": "384:L1UeE7mOk45D2RI/bsKR+K3OUN/Pv22bYLDl7J9gvRCq/CEvjPFfO3zto88fF22R:LYk4tvbsKR+Kd/22oJ7J9gvQq/8zAtsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771953387, "uuid": "bf91a3e4-8708-40f3-bcf4-cbe107efebd1", "value": 21979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771953387, "uuid": "4a731def-6aa1-4726-919e-d6934296df77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953387, "uuid": "14b07e3f-cd1c-4fe7-a8f9-aadb21888078", "value": "archive41.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed45e9a-11d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1771975320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771975320, "uuid": "d5ce5f7d-ccfd-40c8-a67b-adda1b87d2c4", "comment": "Malware payload (RedLineStealer)", "value": "11d120907a5692fd48598573d457b340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771975320, "uuid": "cd057268-47a9-4510-bdef-d18c5748524e", "comment": "Malware payload (RedLineStealer)", "value": "2ec9acdb6e5ea802f5cb40e00ab7e973f3b1abae4033ba46b79e10af695d9e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771975320, "uuid": "74ddbc95-a4fd-4c95-bf65-aaf5a8326e5a", "comment": "Malware payload (RedLineStealer)", "value": "2ec2f409acbaecda5fcc129c9b4f6be417c491e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771975320, "uuid": "6d1d2187-ddaf-4b49-be9c-0f558d6faf5c", "comment": "Malware payload (RedLineStealer)", "value": "50feba5ca6c85d70153acefa114d95eb6d380c901e6596b3dfa1b1c69c4cb2b2f10a852d81c327ed2d9726b46655b810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771975320, "uuid": "5a3f224c-b716-4273-8f4f-75f18250b6ed", "value": "T104935B5F33A430F8D5679174C9E14A46E773B87659B0A30F4774869A9F232C2AE2D332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771975320, "uuid": "89e428ed-5bd7-416f-b914-839648a94ba6", "value": "48ca3036180f0cfc822176b8bce52945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771975320, "uuid": "b7894f82-c06f-4b27-83af-0d9563970669", "value": "1536:gzKPUGVAND/R58vjohR2yTjV6cpFwb5Wnel16W9Xa+t1ku1ZTs0+:gzSU1J58vjohgyTjV6cpFwb3NK+3kgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771975320, "uuid": "4bcae55d-4291-4ee9-91ba-9676350fca95", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771975320, "uuid": "9c12c1ed-2d6d-467f-b06a-d0d50f1e3103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771975320, "uuid": "c6bb81bc-3114-4374-bec4-6c0ccab1c73b", "value": "SecuriteInfo.com.Win64.MalwareX-gen.32545821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a8df01-114d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916007, "uuid": "e243591b-f468-45e3-8715-57edd06c3935", "comment": "Malware payload", "value": "a890a03ff4855e9a5ebf39129aa672e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916007, "uuid": "0954ff88-5a56-47e9-885d-47c0514685d0", "comment": "Malware payload", "value": "2efa369d053066fcadeb8c53e7d360cf7cec87adfb7d896d20e63ddb35cfdd80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916007, "uuid": "d6380b13-ba1f-4d88-bfdd-19b43d77354c", "comment": "Malware payload", "value": "d1374882f9c3d556d3915761848acc1a1e43b116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916007, "uuid": "52c5caf3-a9e3-4490-a571-12be95c74751", "comment": "Malware payload", "value": "690d4c6951c92d5c82fa8bb404b5d4add131123ada2698f03e33d5bf8203a7eb696430a235a90111fd02befb56c1f9d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916007, "uuid": "c9b96da7-c970-499a-a2a5-c3b5f8612094", "value": "T12FA68B41FDCB10FAEA430A3105ABB27F23315C064F64EBD7EA407B29F97B6951936249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916007, "uuid": "3834503c-4f8e-47d7-a5b9-9034e0a84282", "value": "98304:kG0uQP6YUL0bIrtvj2oyMp3Xkz16E4+he9y1X4CScC2G+HunywM1QQj:d5Y/8rtvj2mp61n4qlpj5CUH+ywSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916007, "uuid": "265b7f10-3e16-4a23-92d7-6bdc32176352", "value": 10233601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916007, "uuid": "78304dc9-9b5a-4c1e-877b-7bc389966cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916007, "uuid": "dad734c2-f556-4df0-8f9a-65b61f8e0323", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bf6696-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917435, "uuid": "a5f32961-a47c-41b5-abdd-6a7f5964206a", "comment": "Malware payload", "value": "16680f1ac3d6897fb5f0e2e696ce168b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917435, "uuid": "8cbede21-6378-4cc6-a15c-59282964a456", "comment": "Malware payload", "value": "306991f64972c485c67a2cf4d3930ebd1fa224057cb19af784bba747fb00c745", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917435, "uuid": "6e9db201-b897-45e9-b4a7-41c3746d962e", "comment": "Malware payload", "value": "8185eb6266836f3d793934b1676c1bdea0df6189", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917435, "uuid": "4fb629ec-efec-4d34-9074-9c7689707809", "comment": "Malware payload", "value": "95e325bf78acd7c735559c04cbdccfb8a8e961e9bc4a67ef6f49d358d72e8ee7f5a9b54b380551a2ee8896aeaf4e9278", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917435, "uuid": "0732aa30-e9ee-4e0f-9275-9426d733f74d", "value": "T178D3F8E14C4EB51CD2582A847BFA4B6CA98239BDD24EAD88B9F75054C31F1FF81C69D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917435, "uuid": "2cf56d13-37ef-4148-afdc-486ea9a7c384", "value": "768:C8m/Z6sZjWsYuSwnckNuRgWJnEF2prixeLScFYHXwz04mYF6F2r:CPXZ6uSEYyF2pO4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917435, "uuid": "784197ef-7063-4ffd-845b-7721b63b508a", "value": 135138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917435, "uuid": "b17c9003-6569-4dcf-9bd3-53735192e9cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917435, "uuid": "be0c6a76-8ecd-4b40-bc7c-1392c56f4374", "value": "invoice-1645080830.pdf (87).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f770c3aa-1140-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771910615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771910615, "uuid": "ad3de672-d2cd-434a-b8d1-8cab0d3056b0", "comment": "Malware payload (AsyncRAT)", "value": "fa71bd60bf3f98b2c26485312ea8f34e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771910615, "uuid": "12208f80-841c-4529-8951-fe053f96bdf8", "comment": "Malware payload (AsyncRAT)", "value": "307b2f1f1c5ea369151a5df85d9907f589a5b30b8245028436c825b20cb8cea9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771910615, "uuid": "ec2b9b5a-dd23-4238-9fa0-45fc8af03a21", "comment": "Malware payload (AsyncRAT)", "value": "8209beeedca8c5f8be9adb316c2d96974c27ca37", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771910615, "uuid": "8f9a7906-f090-4d4f-8c2d-309b6242c79d", "comment": "Malware payload (AsyncRAT)", "value": "5fb350155ff77b762d5ad72d736077d93069965d5b50ffbb9aa75c1109f47ef8cfc59ffd35666e9ff3b000d9662ce36b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771910615, "uuid": "3ccb561a-b5a6-48c2-ae01-42c2957b292e", "value": "T13ED23B08B3D48562E1FD57B94D7292048771EE4BA973DB9E1FC441AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771910615, "uuid": "696b7785-fd46-4459-8f9f-10afedaafa83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771910615, "uuid": "41232fd8-4f7c-46f7-9ae4-da915026981c", "value": "768:O0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dT2/+:hoRXD/qymB1iwRbN/s/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771910615, "uuid": "bdf5cbb8-d33e-46f9-97f1-b858bb350247", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771910615, "uuid": "953ead14-442f-4a53-ad16-62875ee4b359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771910615, "uuid": "172e1463-e4d8-44b5-a756-1adcc98dd312", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b75030-11ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771957001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957001, "uuid": "eee6495f-82bc-4233-aa3f-8641694bc3cb", "comment": "Malware payload", "value": "c105144d823ccba49db9f3008df0a937", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957001, "uuid": "3f88ac51-d5e6-4289-a219-c849e30b5079", "comment": "Malware payload", "value": "30be200d5895c938e576d794e625d42eef3ce003ac54c87ac363298f18363004", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957001, "uuid": "fb5bb958-664a-4bde-aed3-181e988ddaf1", "comment": "Malware payload", "value": "2b7872693deed29e435936fd2386e5ac5a7dcb7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957001, "uuid": "60f4fde3-fa29-4953-bbef-2aeeed274537", "comment": "Malware payload", "value": "38a12790bf8a8f93f94ab68dd43a49de5397350d338823535a8b0c911d321aa718245cf6201dc58b7cffb7ed44e9f229", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957001, "uuid": "a5239a6d-031a-4bb3-89d9-20bfb302cf1f", "value": "T1801423846596190AB37F8DD5EEEABB922F09075B06432CF1EFC5E08FD69A6C50037C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957001, "uuid": "f2ec363e-5269-4815-8691-823d1fcceb48", "value": "3072:7dhtrNz1bZPkxUBhrdcepx726cqMbm0MHwzvReDv96gN662VE5PxbbhhWyZts:7dvj1sxUBhrdcePncqomgzvRe8J62StG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957001, "uuid": "bb5b8b11-07a1-4d00-9c5c-30534f61d7bd", "value": 190759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957001, "uuid": "2629ace0-f7cf-4af6-bf5e-fb9482b7c3bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957001, "uuid": "e26c0017-c27e-40a8-a441-d40dbb8d2ffe", "value": "30be200d5895c938e576d794e625d42eef3ce003ac54c87ac363298f18363004.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93489138-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919466, "uuid": "efc0e2b3-49fd-4436-aa6b-cbacdb0ab675", "comment": "Malware payload", "value": "8c9d0a67e12be0e3d242343f78a9daab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919466, "uuid": "b222664c-93f4-4cc7-8d76-6306a9a18935", "comment": "Malware payload", "value": "3134d25633b018c2c2ae7b8749b5a418c6a5adc6b51736bf6d1f8d3977ad3ccf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919466, "uuid": "35995ead-d144-4162-88b6-09b049c449b0", "comment": "Malware payload", "value": "ea392866b7806dcc36c80b941059e2c56d7d3ac8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919466, "uuid": "f842d2ab-0830-44b1-8491-95be009d2f46", "comment": "Malware payload", "value": "2f1c2bce4ae945bbe2faf7753e393c7b4540de033b43cfa5a75c733a256d88a6abe951a55fe70a10da37e65e6efb8371", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919466, "uuid": "0a9d806c-d391-4b19-aa70-6eafb7ae3788", "value": "T1ADD3173547638DD1BA94EBA304CAD491521ED9DAECE83521CB79FAE21ED8B48C731313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919466, "uuid": "a2e05189-b9b0-4ad9-8326-922d68e39fdf", "value": "768:C8m/Z6sZjWsYuSwnckNuRj5pt9FSFXsxeLScFYHXwz04mYF6F2r:CPXZ6uSEYtpkF84YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919466, "uuid": "e934cf8a-18d1-4f78-8fcc-fa0b148477c3", "value": 140920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919466, "uuid": "46794a5d-a49c-4666-b51b-5516c1b86321", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919466, "uuid": "7146dd09-1335-4f43-9020-072d9c85ad8c", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940c63d0-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928916, "uuid": "6744350e-9e51-4692-991e-72078b910cdf", "comment": "Malware payload (Mirai)", "value": "0033941a9d0c13cc30f5c03a50802741", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928916, "uuid": "66ca9766-5d17-42eb-a59f-ac4a6f0ba395", "comment": "Malware payload (Mirai)", "value": "31af1db6566957107651b57ae90702ba49b78b856de9411e087cba570783db66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928916, "uuid": "f5b09487-8a51-4de4-8d3c-91378ff2540a", "comment": "Malware payload (Mirai)", "value": "53f5b19c67ce0b6cff954c2bb88704358bcd51a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928916, "uuid": "c4aab511-483a-46f1-ad2b-0c60e00b51dd", "comment": "Malware payload (Mirai)", "value": "ba7c9b77b87aca657bf068e27f9dc89ac8966e3ccca1bee5046a18ec598c13def9f438bc9f9fb258c1781ffc7c9f9420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928916, "uuid": "ba60be1a-ca63-4a96-a49b-5927b3423e28", "value": "T1BC83188BF801DD7EF80FD6B74463490EB930E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928916, "uuid": "257eba49-8f63-4c10-ba57-0402ab7fbc46", "value": "1536:XQOjxmw2V2xAYV8aSlslcjYAht8f489k0rTUhrIpu1HT7ot4O9I/nPaKD:XQO4QEpdht8fsnrCupQ9I/PaKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928916, "uuid": "2008803f-c636-472f-b79d-d93947c21519", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928916, "uuid": "ae4c5a39-1236-46a2-ae08-25fd4846234a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928916, "uuid": "20f4b8d3-3147-44e0-b9f2-7f4566939623", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda1b102-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896854, "uuid": "16605374-abb6-4a34-badb-54267bdaefec", "comment": "Malware payload (Mirai)", "value": "b4358ee44b7650bbb29d8873b40bdc2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896854, "uuid": "e8f5af79-ccf3-4091-9512-7e181e45a4b6", "comment": "Malware payload (Mirai)", "value": "3269107ccbc88baad0fc67fcdddfb95861ff8f9ef304a7bb4d4a482036484edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896854, "uuid": "68d15699-4839-4ad2-8dfc-c46bc9f63900", "comment": "Malware payload (Mirai)", "value": "22ff1f87ece20a18f32756a85199734a067cd117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896854, "uuid": "48fdfb97-2716-4d59-8433-bc6f4bfc8a5f", "comment": "Malware payload (Mirai)", "value": "6345399993691d4031a555d6c46066e90e05688a23c2a523857203f8ee3d1c4d34075558e3f3868c996e7791cf0a4248", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896854, "uuid": "09b08697-2605-4a1e-b85a-7a87b9ec4c0c", "value": "T13FC2E0785877A5B2E3201E7B79B5975B37FB07B8CEF925332514972823C41CA28F4982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896854, "uuid": "3be35ffd-d358-42ad-b9d7-906c2c3f3e81", "value": "768:ivwcVP4oHWfu1hAMjLqkxBBmes3Uoz/k5E:ivwSwgz1hAVkbcDzM5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896854, "uuid": "459d38b7-09ca-4d41-bfb1-c1bc0beaf3fd", "value": 25876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896854, "uuid": "edc6e6de-096d-446f-80ca-9bb0dabb981a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896854, "uuid": "f0c92b49-d8aa-4c87-a7e8-20b42bd39aa8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa49e640-1166-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771926806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926806, "uuid": "56115089-637b-49ea-810a-e53ecee9663f", "comment": "Malware payload (RemcosRAT)", "value": "06db079a21ac9fa9ffb31da92bbd3fee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926806, "uuid": "0b28a374-de7b-4cb4-aad1-7ddd73f1902e", "comment": "Malware payload (RemcosRAT)", "value": "329a4ab657a978174363266355cdbbd9895dfb1749a3c1057b9e42a5aae9860d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926806, "uuid": "487b44e7-3b7c-4e0b-93bd-34e6b44b604f", "comment": "Malware payload (RemcosRAT)", "value": "52b8b15c32c649a32c3cd127e54583d19bcad632", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926806, "uuid": "1c0674d4-1211-4c76-8038-a8696c9a9969", "comment": "Malware payload (RemcosRAT)", "value": "52c56d2c9de7f415d9ebaf158c0dca171d38cf1646c436386d925b0b5000fd61e8af85c7660410fd869096dd98067952", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926806, "uuid": "3e13782a-7324-40e4-b74f-3b32c54d5799", "value": "T12EF1857CC5B9F8C0472F3240B4DBD4DA109B9E13CF775AA8D52808996FA5324AFA495C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926806, "uuid": "a1f3a3d4-d8f2-470a-a900-dd83916444a7", "value": "192:34BABvQLj2ijD+HZ6GVo+5z3LDCxjVv1WmwUQVnG2ti:3QSsSiOHVo+5z7eJVv1DKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926806, "uuid": "ae5fde19-cc1d-4fe4-a403-7ca433d22323", "value": 7965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926806, "uuid": "c3834135-19ac-4658-83d4-159a7871ad60", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926806, "uuid": "17377506-e818-464d-9138-3d7058d03d48", "value": "SOSTENER2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9555bd42-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952541, "uuid": "b1b38f08-026a-4981-b632-8582717945db", "comment": "Malware payload (njrat)", "value": "3fcdc267b86100a6f7ed8d647c92f0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952541, "uuid": "242bc1c2-6fae-472f-a156-2fefc0f68c85", "comment": "Malware payload (njrat)", "value": "32d5d899bd5ff3460f5cc5c0e6b0594f13c2dd620ed19dcc825e33d84864b7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952541, "uuid": "7403a8c7-a880-41c6-8a39-3d68efbb507f", "comment": "Malware payload (njrat)", "value": "893c183a04da226a9bffd63a7cc4333f85813e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952541, "uuid": "b9398060-2010-4f40-b68a-f505146c6b76", "comment": "Malware payload (njrat)", "value": "17e739ba522f93e1c2aaeea06849442c29564088ce3a4ef8266174fb2f60ccd7014d4eb6c1031f281cd26eb88365f374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952541, "uuid": "81475a04-d942-4a92-87eb-b87c9348d9e7", "value": "T1E764E11B21958162C0EE2E350C12AE1192F2DF4B792AF75E7C9D74C6AFB33870656BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952541, "uuid": "dad47261-9220-4224-99e8-70beae21c27b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952541, "uuid": "6f7d63b3-071d-4f2c-a63b-db1fdb7cdd44", "value": "6144:STzAbn0b8fiy8PX5p0j9bMSYZ9mTzAbn0b8fiy8PX5p:SoL0b8KB5p0dLoL0b8KB5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952541, "uuid": "ad868d3f-3bff-4d2d-bcea-108fcb812b8b", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952541, "uuid": "991dcd4f-6428-4800-8452-5e979ca7e556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952541, "uuid": "9aa824da-e13c-4c38-ab02-fa9acb4161f1", "value": "\u062e\u0627\u0635\u0629 (VPN).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600f0acd-1187-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771940855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940855, "uuid": "25df6ea9-b2b5-4d9e-9e9f-e226d89d7269", "comment": "Malware payload", "value": "83951e2fe898291c492478d6421f4ec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940855, "uuid": "9f751fc3-8737-44d6-9b08-e176176727df", "comment": "Malware payload", "value": "336bc7806fc9521a2fab33174e9aab3a2d2d41ce4708d1e5df088db48820754a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940855, "uuid": "007a02aa-215c-42a3-84f3-51b1030a7576", "comment": "Malware payload", "value": "51edfc4c34d0fb7714871758aee7c7610bbb5d82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940855, "uuid": "42c42f57-1afe-42d6-b6d7-2b6ad3d3fc33", "comment": "Malware payload", "value": "bea26e32590cc7fe8ebc7e1e28d2c0054aeedb4454d6926e7a3b7f2994bd2166f96c6eaec090845b1d58c3d4df82853b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940855, "uuid": "693eeeba-9233-4c0f-ba37-33dd9e3581fc", "value": "T1ACA68B41FDCB50FAEA430A3005ABB27F23315C064F64EBD7EA407B29F97B6951936249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940855, "uuid": "91451b52-16fe-4f41-8f01-e84b9aea40b0", "value": "98304:VG0uQP6YUL0bIrtvj2oyMp3Bkz13En+E5XC+bmXXDWK+jSltHunywM1QQD:+5Y/8rtvj2mpk10nXyNHDWKQKtH+ywSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940855, "uuid": "7088a5b1-6633-490f-83b9-c60fb31b95ad", "value": 10233633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940855, "uuid": "6b245494-f4eb-43ab-98f5-d6b166df7038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940855, "uuid": "85a2443b-fa28-4237-afe0-8d1944443eef", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bd9d51-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952513, "uuid": "29520ef1-0475-434a-a3a2-40e4568215c1", "comment": "Malware payload (njrat)", "value": "ea1499098ec6a9191eb46d15f411917f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952513, "uuid": "ee722830-b05a-40fd-ac7f-8e1ed61fb02b", "comment": "Malware payload (njrat)", "value": "33a058ae0249df58cfd86ad2fe8f06a034ad2a9e8991fdc5473b94311becf43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952513, "uuid": "fbaded16-eb51-4faf-92c8-075cda934ec4", "comment": "Malware payload (njrat)", "value": "4ab8fd68c8062a4e1f1b31b91799e9a8c8486981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952513, "uuid": "497d467f-43df-4b4b-a56a-3e9f2c44afc7", "comment": "Malware payload (njrat)", "value": "bdff110641b06e1c0d22c1a56dcad16e13e17c2ae99e591a628ee985fb9550a50a01b47e60b30490dd350299513dd585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952513, "uuid": "89c907b0-6e13-428a-b564-eff570721f0b", "value": "T120A3D04D7FF08168C0FE167708B2E122037BE45F5D63D91E9DE258AA37336D08B94A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952513, "uuid": "d2c4ce30-a2e1-40a4-a2ab-bea39126f278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952513, "uuid": "532c31a5-80a0-4d08-8618-70b3a5e93166", "value": "3072:uZ4KA5+yJNAVCTnIdAh1RkjncPrrv7pYBr:O4KlxCTIStAwv7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952513, "uuid": "bd0241ac-e749-499f-acdb-454187b128cf", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952513, "uuid": "67d44175-f031-4dee-a49f-59df74c4de1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952513, "uuid": "4e34fa2b-a06d-434a-b313-7488ca5bce24", "value": "OwO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b65535-1180-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771937699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937699, "uuid": "251b96ea-057c-49e1-a4fd-bf30c5a998e0", "comment": "Malware payload (CoinMiner)", "value": "a1b8bc2be39402d4e5e2d6d00ac75aef", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937699, "uuid": "670af421-95ab-4f3a-aa8e-71dd56b90f84", "comment": "Malware payload (CoinMiner)", "value": "33ce9f37a425ebada5672108d70584712bba0aa7dd41f70be14875e29943f86e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937699, "uuid": "9d671638-8399-4f2e-bf01-3e9670b38ce1", "comment": "Malware payload (CoinMiner)", "value": "4475b621db171c9ca07e85aff47b4f1022166ed1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937699, "uuid": "8ca67485-a084-4c90-b3f0-b7fcd56b6b13", "comment": "Malware payload (CoinMiner)", "value": "a4c5e3e7bda99fce331c9d6608ba8f83fa1a8e4f7a1c27c1e998dded9807302ce4a5ebd9c1a8d0efc641e635c82abe5c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937699, "uuid": "0fe29792-8d2a-406e-976e-326b4a863683", "value": "T153C08C4DD220BCBC1841CE9EE6EA8E50902E21C111205992632BDE284910581F14C10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937699, "uuid": "29723e81-8005-4e90-8809-b0cdf14a123c", "value": "3:mKDDqWSJJFIqM3Ax3FkepdDAytmAcLhzAK5Dm/Yn1rIe8wJBWU0P:ho8qkK1Rh8zD5Cw1r8CT0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937699, "uuid": "5c3cd151-a828-4f92-9db0-b29d886b8e64", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937699, "uuid": "25dbc8b1-9a37-4d92-8a3d-c6e7c90e8178", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937699, "uuid": "99d4ed04-1e84-4eb1-8266-2cd0c95ea1d5", "value": "install.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c8bdf3-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919339, "uuid": "cee26044-0e28-4ef0-add9-25818b777b24", "comment": "Malware payload", "value": "9abf0a0751b8826579ed4b65f7a4e1ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919339, "uuid": "edac6cfd-3418-42c6-974e-5ddde6c748cb", "comment": "Malware payload", "value": "34b2d54efa9c7b5d74d32a220d83a739608c37f7128774a58eb68fefe8c17d63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919339, "uuid": "0f558e00-35c9-4b4a-9e48-4761ed2458ed", "comment": "Malware payload", "value": "8e2af02b9c3ab7f9d95d1f013404b4f9275e03b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919339, "uuid": "c52cf7fe-dbda-4632-af50-18a32e3a3b04", "comment": "Malware payload", "value": "e4bd035de3916b247c64fc5f06202b778f0d4dd2c0de1b8acf8b013caefda8fe7c7f0b794dc87be790c31b297bc20412", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919339, "uuid": "596b9464-68f0-4efc-a3ba-e1f9d942a3b6", "value": "T134D31C2B21AB50D591F179C5004C39BC9E602FBC8C9BEA4B6B49E03B7E367530B25B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919339, "uuid": "f576482b-9451-4c73-8a3d-24c1d9fb16da", "value": "1536:CPXZ6uSEYRSwwnUQRnAQLq9jR1WPnoSiCK6ifmoRwuc+N/+SfnDpDFERDonWB6nX:CPXZ7Y8ropDK4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919339, "uuid": "bf2661ae-9d33-48e3-b6ee-ac28fc76d8ee", "value": 140866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919339, "uuid": "97a175c4-031c-4e68-9753-3076bce20dcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919339, "uuid": "45cad711-c123-46b0-8812-b83fd2c2411e", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8003c665-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919434, "uuid": "077673a9-6219-44da-b90d-0d81d8a74826", "comment": "Malware payload", "value": "0cc5e0c54183fb7624033a4fbdc6411f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919434, "uuid": "ea518b24-0de3-4fb5-a55f-c013e9e0787d", "comment": "Malware payload", "value": "34c3fa88f85c596e3c4108bf1b89901fda8eb112f0345fc5c251e3317597ee4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919434, "uuid": "0c20af7f-17be-457f-b1fd-11ef59c16200", "comment": "Malware payload", "value": "b03d6622db4fa3a8913d57cc7c085a8937f74138", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919434, "uuid": "da1c1816-72a6-4a79-a7a0-7267cd19d47f", "comment": "Malware payload", "value": "5404f6cece12ddd5386f45a56ceb14646fe072b431fc6ec98d2a05ab94dc1f2d264806cdb3c574017a60e87623c34942", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919434, "uuid": "14cd5a61-77b6-4c94-bab1-209e2b3188b3", "value": "T197D3B53B731230390AE5BEBC55FA03F66562BF408DA6D219D439A528C7D23172C992F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919434, "uuid": "e02ad312-8038-4ddb-99b7-c66fe3901726", "value": "3072:CPXZ7Ydb1isRHYS1RF4vUtwDWDSGQkk7pkI0owb/byHts2Vosciim2syLO10XRRr:Eo5gpzX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919434, "uuid": "dbb9a0aa-2eae-4f7e-bf87-7d85ac122e5e", "value": 140902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919434, "uuid": "75097c76-1ac6-4eaa-be7a-8f270d9e719e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919434, "uuid": "9844f21d-c761-4b24-9e56-b3b7d7bbbe17", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1202d329-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771957045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957045, "uuid": "1524df65-69d9-4322-8713-dee385a20402", "comment": "Malware payload", "value": "36ed71753b1167502e1f44f15208660b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957045, "uuid": "b3212d08-c9ec-4b53-ad97-4738ed9a55b2", "comment": "Malware payload", "value": "3548b82826406a9a64b6fda31d336c622764c92c0d412d244871412c79312da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957045, "uuid": "c44ff751-4613-4e34-a6ba-86c5e831a009", "comment": "Malware payload", "value": "318127af05b902d5e742acd7282b1625da657ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957045, "uuid": "34db21ee-ddaf-4620-b390-9977fbd6020d", "comment": "Malware payload", "value": "1408c752a65a0cdcac435200081b11687efe3cda9ba6a8b6cec7328fc3a2ec0b940eedbf930eced40f4a5843fb7d52d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957045, "uuid": "9b5cd41d-1292-41a0-9b1f-3ae5f9daca74", "value": "T137847D9B8BA2A8F2FD2DC071465D07B1481C707002E1576D665ADE38CF32ED5C7A9BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957045, "uuid": "6e98fe95-04d6-457d-bf5b-d44bdecfe1b0", "value": "263d660754abebc96dbba283842ac98a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957045, "uuid": "9133a8bd-40ac-41b4-bfb3-fd692baf1b19", "value": "6144:hzQLP8Vs1s2VfUkGrFRkOD91oy3/q7Q4xvB/KoS8lMSDF:ZQAVmbVfm8OD91oyuQ4BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957045, "uuid": "8b3ea0ad-0312-4215-ba6b-3880015bc6c2", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957045, "uuid": "583b7712-a010-4850-9de1-4ef15c24ad10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957045, "uuid": "22957e9c-5708-4e1e-9f4e-a22b8886f70d", "value": "tmqqnys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a16e5d8-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939181, "uuid": "e79e4b00-3cab-4774-8b15-1d5bf4de2bf7", "comment": "Malware payload (Mirai)", "value": "b0358e7ff1e4c72ec8a2864da238dd45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939181, "uuid": "38a72a90-538f-4a54-9833-98caf7301760", "comment": "Malware payload (Mirai)", "value": "35b7b56097a31efe1bab775abdd4372f3682f1e70276ad3c2d139a458514d8dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939181, "uuid": "3f4f65c7-42cf-4b65-9336-3bc4ad6cc500", "comment": "Malware payload (Mirai)", "value": "36a45b09d6ff1f23b8250c27852e5bf090079424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939181, "uuid": "2e214d51-6656-418b-ac25-cfac0d03be13", "comment": "Malware payload (Mirai)", "value": "036b630e72f2e39cfd1c020639b310d208e60c247c3cfffa9e1012c7af7b2f3e4b9b02c98205af4674137b2f7cb99ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939181, "uuid": "1b955eed-5613-4427-8c7b-2ccc2c2d5763", "value": "T19F04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939181, "uuid": "229ad0c2-c157-4bdd-981f-691acc103fdc", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2i:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939181, "uuid": "a74c591f-115b-4242-b76e-75ff83f5ff3c", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939181, "uuid": "e047d6b0-9c21-4c0e-b82b-915570b6ef7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939181, "uuid": "7912c3a5-55de-423a-87d8-4c773d826ba4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b68bae-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928944, "uuid": "256da83e-1658-46fe-ab53-67370d3f2221", "comment": "Malware payload (Mirai)", "value": "bad6772df378616cbf1b15253f936f3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928944, "uuid": "9f72a0c9-3041-40b2-a7ec-1f4aa21358d3", "comment": "Malware payload (Mirai)", "value": "35db31b684204fb5ab4e91516622a8448039dded232b7e420c18f47aea8a61c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928944, "uuid": "d9322160-5acb-42ae-a27b-8ada1b183721", "comment": "Malware payload (Mirai)", "value": "c6fc2ee765c18599779962a10a46491d65cfc206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928944, "uuid": "d8df7b02-d09d-4e67-86c3-58486ad1bc4e", "comment": "Malware payload (Mirai)", "value": "3bde5588f99208eaa609c1f37e88cefb61730a63a209d9d708f0fbcf2c1412c71f9e9f5c7bb9ea5a49a1095e75973e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928944, "uuid": "60119b39-b007-4dd3-baf1-4de1afe91589", "value": "T10783185AF8814B21D5C512BAFA1E164E331307FCE3DE72239E24AF7137CA51B0E6A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928944, "uuid": "a65f87e5-9464-4358-8bdd-6237868b9515", "value": "1536:GpnQQmY6CpD2sAKv7isPtBBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtY:4m0D2ym4EZCSHYMactW4Bi9gnS4V0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928944, "uuid": "9e459a23-ca1b-4866-b25a-994406b3a10c", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928944, "uuid": "28a761d2-9bca-4da0-a5a9-ebd975d7743d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928944, "uuid": "b4bf193f-a16b-4ea0-924c-29abcc58019a", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c3733c-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903896, "uuid": "39e53e56-0a68-44ad-a796-3817534c921a", "comment": "Malware payload (SalatStealer)", "value": "35cdeacdc7704836717bdc7da7539f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903896, "uuid": "b8081238-c543-46ea-afca-6092d74306d1", "comment": "Malware payload (SalatStealer)", "value": "3641ace6c64b53ba29afd8b2f33e2a4c479396c5080b625c3f58139c28c4cdbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903896, "uuid": "6f6950a2-e604-4926-9711-753904240da1", "comment": "Malware payload (SalatStealer)", "value": "335ea1495192d64badbfad331b7934e010343d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903896, "uuid": "c4adcdae-49f4-472d-971f-04c62e4a6d02", "comment": "Malware payload (SalatStealer)", "value": "8e87c1242f48d6e4e5b9fe5d24005c7db87063d45ffe070dec5b1790d8adce9020d27c58eaf8fb95e8fcaf474229ddb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903896, "uuid": "922bede3-553f-47fd-b65b-b4e42a385a5d", "value": "T11CC65B51FA8B58F5E9031831416BB23F63315E048B28DBDBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903896, "uuid": "cd957fe3-bcd9-40bb-96fb-681c043bff9d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903896, "uuid": "f16253f7-ea3a-40a8-9909-9f01e600332f", "value": "49152:cFVA6Yr8X6jjdo19z8hUMF5UfueVZKjPJ8n+BYLkYJNo++yOr0fPQoui3LEbWTl+:0i6Yr5d5X8LkR++LmugolpVyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903896, "uuid": "d7293309-46f0-4dfa-9f72-4fc1d8c170b3", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903896, "uuid": "0b73d83e-9a97-4099-8aa6-420e7913a73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903896, "uuid": "6d7483b5-0b72-4484-8e9d-2fd35a4826ce", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83755e7-11bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771965055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771965055, "uuid": "255cb760-18c0-49ab-a61c-b2f1d1e54da7", "comment": "Malware payload", "value": "964772212b827f816e5090c6a02b734e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771965055, "uuid": "f7db5b7a-6ff0-4054-9a0d-15fe6ff3ad26", "comment": "Malware payload", "value": "365fc1ab1ab308a79ca879f7672928ebf05522a7240221d982a61bf018414601", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771965055, "uuid": "f9565aca-c3f8-412d-bf44-3cc5cf0c254a", "comment": "Malware payload", "value": "1323bc823a4b15cc5a1a0a7389df85676dd12d60", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771965055, "uuid": "3620c8b1-f151-4a6d-9bfb-b707ecdd3145", "comment": "Malware payload", "value": "2985e8e06598031c2c063f43a4d74bc8cce735bb8b3e93d884a0de830ef4571b3dfc9156e2d56bf51eb1d3c0fdcbdbed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771965055, "uuid": "9c09c0a9-c51e-4517-ad47-752333d23db0", "value": "T1F3925BB916496C79BBC0DE7D9F3C7F0CADE881C02118A3ADBA4F39614A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771965055, "uuid": "497936e0-4682-46e3-9073-208a1915bf8b", "value": "384:02l0M3vgRjGlsaq7XzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:02dmjfbzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771965055, "uuid": "abd0bccf-ca56-41a6-bc56-eaafb8dec193", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771965055, "uuid": "ebfb7d82-f43e-4e38-91ee-1796e581d323", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771965055, "uuid": "7f137cf7-7ab8-4539-bbc3-bbb13bd544a7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f2aab9-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939167, "uuid": "3f1dfa09-d753-404b-9587-d418f464789c", "comment": "Malware payload (Mirai)", "value": "e3c5bdc5d0c37a675444bf003e1c19b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939167, "uuid": "fd0256ae-d32b-48a1-a799-a1448ee088d3", "comment": "Malware payload (Mirai)", "value": "368811f88687b64dbf1085f9c6df74cdc3a4713d08d763a68d2764d82fdd0bdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939167, "uuid": "a80abc19-d11d-4d3f-98b6-d27181464796", "comment": "Malware payload (Mirai)", "value": "a3a261032b88d63678f60ec09e1d008d8e734517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939167, "uuid": "ed775969-08d0-4caa-9d76-51d2c2b91b56", "comment": "Malware payload (Mirai)", "value": "98ecfa3472b490a5bd4f116f21b5964aae73787b65c4f24a32e9cf460ba3ad21c2225c9a875ffae7c84b4b898e15fbab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939167, "uuid": "7bcc563a-c745-47eb-b252-e1f9a9c9da4f", "value": "T14E344B45FA418A13C4D217BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939167, "uuid": "5039a467-fcc0-4d02-acb2-4c2459e7359c", "value": "6144:8KbtT30/9azauKacEK1dAnJd7BTfdfM/9hVdAU:8Qx0VazauKacE62JXB0/HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939167, "uuid": "a20467d9-79fb-4363-91b2-e2b783ed85bd", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939167, "uuid": "08dc2bcf-3788-49dd-bc28-ad4dd637790e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939167, "uuid": "8c8b3ac5-07e1-42e8-9c84-cd24e779d655", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156f340d-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771916678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916678, "uuid": "4c426e74-1ea8-4edf-bd07-36322d1ca632", "comment": "Malware payload (njrat)", "value": "a26ab65e2dd5e0b4f515416a7fcc5827", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916678, "uuid": "e28bec27-3895-4b80-8e05-345f8870009f", "comment": "Malware payload (njrat)", "value": "370d5d67e30773e2615d32ca4214aa7a556a51c0202e8252df49adfe09ec4604", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916678, "uuid": "b2bf587d-7b9c-47a8-82a0-15de6a49df9e", "comment": "Malware payload (njrat)", "value": "a7b2f0a3ecca12956ace05aebacc3d978b16cc85", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916678, "uuid": "866802c5-0e9e-4c6f-984e-061dd8a78afa", "comment": "Malware payload (njrat)", "value": "9b923044299144a652760b930d9f67155bf883a8e36fa8fd857ca14c5b70c92be6df23b475d8e56a252b19139ccb9031", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916678, "uuid": "73a12d5c-9aeb-4424-ad45-f28966b593e1", "value": "T1C9A48D7D6F87D3905926D0A0BB68B264B3B9043CDB3AE95A3F57E12030E5F7D19CA109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916678, "uuid": "90c742f7-c5fc-4953-bb0d-d5702fa2729f", "value": "12288:w40d58whxEvPOirvczBJbn6EVTx5rms3PhXy13fO0ld9h:yd58whZirvAf6ERx5FpK9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916678, "uuid": "129f0491-f8f6-4ce4-a0d9-1bf111606252", "value": 482866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916678, "uuid": "10233422-6d8a-4dbc-bee4-066577a5b326", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916678, "uuid": "e1797fda-66a0-4129-9a49-92facc08b02a", "value": "ENCRYPT.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d2859b-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897345, "uuid": "bd532f02-43b0-4f2b-a910-42f9ce7a4394", "comment": "Malware payload (Mirai)", "value": "fd40f5cc62efcd7c3f4c04910e9689d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897345, "uuid": "ce3a8d8d-f187-4146-90eb-e4751c7c9107", "comment": "Malware payload (Mirai)", "value": "37b12cc3ff81876c3ce04db3a9544416b7a5384cb41f2190d1041386819dd208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897345, "uuid": "cb23995e-df90-404b-8ea9-ca6abfa85866", "comment": "Malware payload (Mirai)", "value": "2ea29d430c25ff6e25dc9a5aa1dc848b76db1df2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897345, "uuid": "3ae4aae7-d892-4788-80cd-e438803650ea", "comment": "Malware payload (Mirai)", "value": "89dc16a68a1cf3492bcb0510534760e5caad6cff66b224857512b5e39ba4ce64272f08b3674195335e01d94dfe15f904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897345, "uuid": "b4b3657b-25a7-4a72-80b0-f7e769a8ec58", "value": "T12713F143D124CB2DD1CD5D3C3DB6A8450910D96F22A98D23E7DE7537281BF212DBB2AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897345, "uuid": "af2294ba-9e99-4106-969d-aed5ccf1c73b", "value": "768:LTAkhfe4CdVgp+QYLSl5wBrEfEMC0pk1kuCFcPZwW+p9ujWnbcuyD7UHQRjf:3Ae244cQREfA1kNFijw4Wnouy8Hyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897345, "uuid": "0085d216-2133-44b3-82d8-1a61da39e99f", "value": 43284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897345, "uuid": "0a10d282-1f42-4e9a-a092-fd7878bc88c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897345, "uuid": "ecb73184-4312-49f2-8682-aa0976635a1e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b87c95-1158-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1771920702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920702, "uuid": "1882e6bb-e4a3-4aa8-9ffa-c1b29ba6bf87", "comment": "Malware payload (NetSupport)", "value": "004aa11f28e606bc6c2cf4fb85d97487", "object_relation": "md5", "Tag": [ { "name": "45-93-20-132", "colour": "#D03785", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920702, "uuid": "d463f9fe-3180-4997-877d-628c57918b7c", "comment": "Malware payload (NetSupport)", "value": "38318f7260d39211961a332ad492c40c9da8f9c3007a68574d8d40501f67a8be", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-132", "colour": "#D03785", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920702, "uuid": "1154686b-81dc-493c-b7e1-17637563a6d0", "comment": "Malware payload (NetSupport)", "value": "3ccbe4f3ea0c0867c2c8e87efc18f71565a29ceb", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-132", "colour": "#D03785", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920702, "uuid": "b29ca12a-cc88-45d2-89d6-b2303fa658e5", "comment": "Malware payload (NetSupport)", "value": "bdcbcc6b3ab43ac3876c389a506b28b24faf092e9ad78156f99e848f6be0d0f8645a025f4444394f8984ab3bccebc5ec", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-132", "colour": "#D03785", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920702, "uuid": "4b12c719-d9af-42f9-b68f-cfeae2a56711", "value": "T13EA533CD08C43EFCD1AD7EB4148FDD6E819ABF50E9E5F2A185B594213AD60E891DE02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920702, "uuid": "5a4cf245-341b-4c05-b54a-06349c1fd5dd", "value": "49152:KOsL3HYZuc7b4vR7B4ezGJZBORR7ZH1FkOMb+HFZst:0oocgvxBiSlZH1eOmwFZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920702, "uuid": "7ebecd33-2cf6-41d7-bbfb-be24c21355ca", "value": 2243040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920702, "uuid": "346d71da-35ee-42e5-be84-30400ba9c7dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920702, "uuid": "09791b8c-e57d-42d0-9428-d94f227e00f6", "value": "38318f7260d39211961a332ad492c40c9da8f9c3007a68574d8d40501f67a8be.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c24681-1178-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771934471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934471, "uuid": "2aafaecb-5891-48d2-9141-d9d44463593e", "comment": "Malware payload", "value": "1f91eb065af62053cf0ef99a4efa58d0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934471, "uuid": "dba4a047-5e16-4551-8eb3-f107f67c09fc", "comment": "Malware payload", "value": "38b9b8c592a8f6a5aaf857ec28cd40df259f75cb8822f73305b8d357f339885d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934471, "uuid": "4df6f2e3-a2e3-4649-b4f5-6a87f10dd25b", "comment": "Malware payload", "value": "89ddc48c0d7b7af7d441f6bf4d6e1610e4124669", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934471, "uuid": "0b4d3788-4eb4-4ae3-9c2d-b9ae999184ce", "comment": "Malware payload", "value": "195add3ae49e18275824c4e5d1f399f39d2d7ac3488b1bf6b4f1a1cf60bd8009f8a8c8042a8c88be85da56cc6b6eb02c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934471, "uuid": "a78a81ba-fd1e-49f0-ab02-217e6f23ea0c", "value": "T185748EA51ED3107022637E6F622F71ACF5760E678C44F96ABA0CB1848FCD85EC9B2574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934471, "uuid": "a4ed616b-ea27-4d9a-8f31-16c4c31edda5", "value": "6144:eCe3wam9LboajdUsOGXRRHJJQ5lhRi3D9lARy:Xe3wam97PRxQ/UjARy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771934471, "uuid": "9bd0fffe-0a30-4496-baea-5ce50c390193", "value": 346856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771934471, "uuid": "f3a3d598-1890-4c09-becc-7510523bfa6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934471, "uuid": "c56f3e2d-a8ec-4c7c-bc7b-4f9e1155f481", "value": "ext.13808051b124.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04878ea5-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771957022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957022, "uuid": "62a30519-b2a1-4f1a-aaee-c1cd122815b9", "comment": "Malware payload (AsyncRAT)", "value": "3ad5db2373ef65590fc13a9335208aeb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957022, "uuid": "9c21e1c4-7ad8-420d-bb95-475247e062b0", "comment": "Malware payload (AsyncRAT)", "value": "3902712f6acedecf0daaae9d501089a8d57fc11f2bc02216ffb28700700ac670", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957022, "uuid": "3e37e16a-6816-4347-9961-22df47c80ebe", "comment": "Malware payload (AsyncRAT)", "value": "5905688d238c77ebfe958f9b05da7f58f29e53a2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957022, "uuid": "28a96880-b5f7-4af6-b77c-ea75ab13c84a", "comment": "Malware payload (AsyncRAT)", "value": "4824ac561bf93ff45a3909d4184eed79d51deafa49ee0448ad3c4178a96fbf7fb7c02665607145054232740694be2dca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957022, "uuid": "32499e80-ef5a-4d18-bb38-487d724fcfc3", "value": "T1F2E23B4877E08312C5FEAFF02DF2710A1675E11BD923EB5E0CD88A962B67AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957022, "uuid": "ebde4bcb-9135-441a-8661-f58648f3f640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957022, "uuid": "1516885d-725b-4dcc-a859-30eaba37eca5", "value": "384:DRaJWq4Ava7Rm32oDuuw3+q5XwYeLBEHvh0FbOKTCOQ9+R6pkFTBLTAOZwpGd2vp:IxC3fOJ5yHvGFbO759+DFo9jGOjhGb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957022, "uuid": "daed2799-d3a1-49c3-a7d3-0eb5d459b541", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957022, "uuid": "40fb9ed1-5bd0-4f2e-bd27-3445a89f1625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957022, "uuid": "a3865f14-7dcf-4648-a88e-e89af97ecad0", "value": "DarkClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a130ef32-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947407, "uuid": "8bfab9a1-8210-428e-a3b8-054d43c62e31", "comment": "Malware payload (AgentTesla)", "value": "22a6538aa1729bb742ccf8ff0af6e2b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947407, "uuid": "85359ae5-c613-44ec-962e-bac211557a55", "comment": "Malware payload (AgentTesla)", "value": "392e1b6ab3702ec39cbe2742f8fed047c723b9a8bea31f33289167f997880009", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947407, "uuid": "c6246e80-a30b-457c-8496-e6e866b01742", "comment": "Malware payload (AgentTesla)", "value": "6676bda4615428d7cb0ed71d73d3cb6bcc8d96db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947407, "uuid": "aaa1eaca-ce29-4f13-88e5-3de146c39410", "comment": "Malware payload (AgentTesla)", "value": "b3eae42e4f6337c503408fce51b5d5d6c6f431777f8ef33feacf073904000e7184603866142ebdbe2c2d6ea539de8a20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947407, "uuid": "ee135982-0b43-49f9-94c4-73ebf0b55d38", "value": "T1B5453345AB8AD072DD6201B3CA522AFDE27CEC05D542C42B727DBFB33E312822919357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947407, "uuid": "9b76da4b-ba73-4c13-887d-ce4a36b2ab3f", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947407, "uuid": "ae9f84db-0c87-4287-bbf9-06d2974f74a8", "value": "24576:CoLLF0f536wllsDb9NbmeqzQWxOqCuf7eg+/CnGVWQgGX6RxXEkLb9Eragr+R1X:CQLF+6zqrOqCuig2VWQgg6H5m+gr2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947407, "uuid": "bf2f768c-0819-46ef-bbe1-9b95ed28e125", "value": 1215032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947407, "uuid": "fc734a86-3387-4335-b386-2f5b6557d9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947407, "uuid": "a3b17077-e73a-457d-b958-55cd2431c42e", "value": "P05996J6GHGNGBGHF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e0142a-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896603, "uuid": "2e063411-86c8-43fd-9906-a75fbf3551ba", "comment": "Malware payload (Mirai)", "value": "8f57e414593257fedabd8a54b3c252a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896603, "uuid": "b82940fc-8062-47d7-9a1c-d4fdf6409cbf", "comment": "Malware payload (Mirai)", "value": "39af2f3f82efd7ba9d60eb78e2120c9f8c3a1b0b725e99a64a61b6260ce1296b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896603, "uuid": "d0186818-6656-497f-9f67-0fe1e8ed8a6d", "comment": "Malware payload (Mirai)", "value": "360d0f3d4869cb32bc6ef6f61dbd3f9ee070331f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896603, "uuid": "e96d783a-f258-4f7a-a341-dfa136f2ac05", "comment": "Malware payload (Mirai)", "value": "db5b5e92f9a36040ee24b1c9470f964198e7032207928e5246d627802f584f0e1a1cee6f40491cd1750b4478c5414522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896603, "uuid": "9f23cbbe-8aa6-44d3-bfd4-0e81144c86ef", "value": "T114733A96FD814653CAD112B7FB6F428E372623A8E2DE3203DD155F11338692B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896603, "uuid": "a69d51fb-d831-4c57-8e33-cc09b2662895", "value": "1536:UQp1TiK90wC2BF7HxYoK2L9+v94uFDbirgSAV/RJmu:UQzTiK9pVGoK0ovxFDesS4/Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896603, "uuid": "0b280c62-468b-4869-a391-bf018310ae20", "value": 77376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896603, "uuid": "3acc4d15-592d-4e88-b25e-a5a7ada7598a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896603, "uuid": "2b58d117-5273-49ad-9885-d1f9e234e799", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755d0375-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919416, "uuid": "aca59d2e-57fc-4477-bda3-114cd16073ab", "comment": "Malware payload", "value": "879ea45e20a9d1931ae78d74a9fe9cfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919416, "uuid": "567a1295-032e-4672-86a7-1e0e464833d7", "comment": "Malware payload", "value": "3b26ecca81a4b41b82fa334c2f0c745422fa701026232cee78128b215d82f386", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919416, "uuid": "8e195826-498d-447d-a709-29eafed59e88", "comment": "Malware payload", "value": "830ea3b296471a71bbc57efe67fee93f8bdea221", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919416, "uuid": "a7153e22-7ec4-4817-81c2-f86be0a90f59", "comment": "Malware payload", "value": "937add9cfe3c658188727064ce47b0a8528b250bfa9b6b64de14467bbe44a9734c7968dc51c8ce9e599e3ed49817b19b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919416, "uuid": "edd65692-da0a-4b7d-9e5f-c870a0f1e3ca", "value": "T138D3C63DDC59DFD1C09F2479C4A8474E438E0CFECD252A91AF5B1A4F018D9B2A6639B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919416, "uuid": "c0249733-7df6-4502-b9b7-61fb90361511", "value": "768:C8m/Z6sZjWsYuSwnckNuR3kDcMMZGQyixJiqGkAFpGKhYypdGCG7xeLScFYHXwzD:CPXZ6uSEYkFBpy4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919416, "uuid": "b4b66a6a-b1c6-4255-b2c0-ca4a8fd23146", "value": 136071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919416, "uuid": "7051385b-c4d0-43e6-8621-88362e977568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919416, "uuid": "0c47b501-6c3e-48ad-a9ca-e9ff19b4d2b0", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee8afb0-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917526, "uuid": "a48fc10b-b7a2-4f1c-9971-a3b3d6ff7d7f", "comment": "Malware payload", "value": "b14ab2962ec807ad95b20b0114a8d78c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917526, "uuid": "5122e381-357d-4c6c-a2a5-33dfaad35d04", "comment": "Malware payload", "value": "3ba91d89f7472bf37265eaa8bff34064297810853d3ebbdf4249c1d93b6111a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917526, "uuid": "df8dc045-5d6d-4fdf-8d3c-b027b1276818", "comment": "Malware payload", "value": "4fc01533ff148a300d222b85e980c8a72126bc64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917526, "uuid": "4fc96871-3afe-402d-9b70-95e589ba7d1b", "comment": "Malware payload", "value": "35e0a4f6bf0dc060f7468514472cc0a6f3d9503c137f8353c86064a869d6da4626fcf51bc086a0c94bf4a174dfda4c1c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917526, "uuid": "2f99abfe-1042-45e8-9850-c54374472430", "value": "T138D3C87947E33D7E0FA33C3A3D1F462C506931170259F69877AD32B31DACAE5A9A6024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917526, "uuid": "3b2415d0-8d77-4761-bfb6-0b314967ab79", "value": "768:C8m/Z6sZjWsYuSwnckNuRlFfs/YWHOpMYxeLScFYHXwz04mYF6F2r:CPXZ6uSEYlFEOp34YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917526, "uuid": "7aa59616-d299-408e-8dda-090354bfa040", "value": 136071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917526, "uuid": "c86ccb15-a0dd-4947-94e8-cb1a261b6a48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917526, "uuid": "4b405267-066f-4c3d-bb60-2d46f6fd7fb0", "value": "invoice-1645080830.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b977ac-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919578, "uuid": "8be2b2a4-3213-48bd-b62e-360a4b990234", "comment": "Malware payload", "value": "6ccae91a8239b830c9cabdc951a918be", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919578, "uuid": "489eb456-fea9-49fb-93ea-4504c3ad581f", "comment": "Malware payload", "value": "3c112776a805d34920614b4e1c5e1ced2cd1d03e818dd461937a5bbb55369764", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919578, "uuid": "229d88c4-fe6c-447f-b6d0-4ec2920e7b21", "comment": "Malware payload", "value": "7aa93fedadc3ebf4c0e4a8ee21672a9ad5cccb68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919578, "uuid": "f4795015-6a4c-410e-af66-49585e5ed7cf", "comment": "Malware payload", "value": "762ff1d5baf69db67f5ce7c129a42cc8e61ed16ec0099e9bc781ad0b9a603f0db808f59cfcc2e21e12383c85a89a636f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919578, "uuid": "dc5b4251-337b-40f8-a51a-37f976afd00a", "value": "T101D3F9AFEEEF05C5289CF5A149803D15FC5DA9E50AA14B793D0B1D41F622E4E4F08AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919578, "uuid": "ddfc4412-ff00-4a7a-94ca-8bddd55ed313", "value": "3072:CPXZ7Y7vuDaEjtx7LsgHhFBdsdl398k9xfuLPQbBTzrJ7HalvPH2aYQad8OWMMQD:ENtp/X0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919578, "uuid": "d3595756-f2eb-43c2-b3aa-5d763233adbf", "value": 139930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919578, "uuid": "6991512e-f1d2-4282-acd1-22fdd9fde47a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919578, "uuid": "9a9789b6-8605-4327-be41-ebc604ef650b", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3432f29b-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919307, "uuid": "4c7839e2-72d3-44ec-a332-119333127cf4", "comment": "Malware payload", "value": "0ee24a9a79a0b6ea9aa267b92fa94141", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919307, "uuid": "867a0e20-19c2-4cd5-b398-c6a647f174d6", "comment": "Malware payload", "value": "3c60ba049c17818565290497cc1b93cbac9152b871da3f993bd5504a52f59775", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919307, "uuid": "3098efc1-8510-4a1e-b1cc-bacccfb0281e", "comment": "Malware payload", "value": "a1c1c78eecf27b60b2ec4bcc89a21768cb7c810b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919307, "uuid": "45dc6bbe-e19e-46f4-b42d-764488463795", "comment": "Malware payload", "value": "14aa86c2962cbd1f3c2376be295e98881e2cc8de19257bec0c330547a0ca52256a10057b6780e6502e89bd7838dd86b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919307, "uuid": "18f1709e-80df-46aa-97d0-9d511a35c48c", "value": "T122D32B53F7273BA684AB8CE5D55D5BAA4CE5811C808941FC2E3BA0278017B1D1E77B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919307, "uuid": "808b3681-1081-487f-8800-ea2d6fcd07f2", "value": "768:C8m/Z6sZjWsYuSwnckNuRppRF1vzy9b48xxeLScFYHXwz04mYF6F2r:CPXZ6uSEYppRFk9bX4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919307, "uuid": "15bc2fbb-4bdb-4c16-869c-829ee0b0e830", "value": 137030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919307, "uuid": "530535c7-ee6d-4af1-be73-449982620c32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919307, "uuid": "2a56a6c0-9440-4595-a6cb-afa14acec3d5", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ac7446-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919557, "uuid": "f98708d4-dd23-44d5-9e6a-88068bbd7ec0", "comment": "Malware payload", "value": "def9f713bc21d87e7779cb3b1a863f35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919557, "uuid": "8bf68581-7216-4fad-82d0-0f6f9aecbb39", "comment": "Malware payload", "value": "3d29a652e8233ab504704c0cfe2a9d7c084a659ccb7d409495e612cb48184f99", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919557, "uuid": "694eb6dd-78bd-4841-933a-e1699e9a8103", "comment": "Malware payload", "value": "2239487f7409b2451e8a02be3bc5f4a86896d612", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919557, "uuid": "4619ed9b-13e3-4181-93d2-9fa41b758c07", "comment": "Malware payload", "value": "fb4daf6a0b055eaa1fbda96f2ac16e04701e6462c5092f089c112933e7121839c52d8889dfe644486283c62b7e23af44", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919557, "uuid": "3f407ad8-ac9e-4b63-9558-f2dbb234c791", "value": "T1EDD3D7AD1FB8262E58E1666C3C2D3A0F530C673EEE14C0425D55E792FC097A7911BECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919557, "uuid": "f597a9d4-4f58-4e49-b1af-ae24782abbbb", "value": "1536:CPXZ6uSEYalpXuTku6D9Yl2+0jI6tAH0O6XqxYo9plkvRwjBw8LzfASUV/xAyZjF:CPXZ7YTiapH4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919557, "uuid": "28d96814-6ce4-47c4-a371-a9761f11fe1c", "value": 137045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919557, "uuid": "b16c567e-257e-49e6-b01b-a4f3f6bd8c0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919557, "uuid": "278d6883-3899-4fe4-a263-1750280a6414", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a789882b-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928949, "uuid": "93ad51e2-b346-41b8-bd28-fc5ce796e735", "comment": "Malware payload (Mirai)", "value": "3bb48fc1cdd913fea86739b7caffa85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928949, "uuid": "b3d96a67-89ae-4053-adce-bed5b7552ba4", "comment": "Malware payload (Mirai)", "value": "3d57b39e7598bf60e0e760dc631de1ea0af36cd63aed3baa20ff80f33c3faee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928949, "uuid": "8312438f-05cf-4dcc-a43a-9d314b3a8697", "comment": "Malware payload (Mirai)", "value": "1c5d2ad6a6457d6fd92f6c8ebc656fc631416ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928949, "uuid": "45555857-a8c4-43aa-a115-198ddd562c09", "comment": "Malware payload (Mirai)", "value": "b463dd67ef551d816a1381a9c82a9c2556c63ff4f1db1090925939a302e4df308bfaa1b68a1c25e08637c9ed4b464fb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928949, "uuid": "4a63ef4e-4071-423f-a75a-07dee46f8838", "value": "T1E2B3AEEBF64715A2C85243F013C79F8E3E232290AE57A4E76D1E267B15760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928949, "uuid": "9821c65b-ff13-4edc-b2b0-2df4ec69c84d", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJu/LWW:6fIw3e8ZE3MYlphDgJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928949, "uuid": "4cb0f378-6a07-41ca-ac40-0d84da59deda", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928949, "uuid": "a54da3fc-feb4-4f9d-902a-c052793a1fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928949, "uuid": "e90421fc-250b-45f3-958e-82cdf2017458", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23cc61e-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771963407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963407, "uuid": "571bf9c8-e5ea-4c8e-9ab4-49e58ee6cba3", "comment": "Malware payload (AsyncRAT)", "value": "0ca0c5680cc7c11c7fbc84e20b6ed3fb", "object_relation": "md5", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963407, "uuid": "050c1cf6-6977-49d4-b49f-3d0431cf5e61", "comment": "Malware payload (AsyncRAT)", "value": "3d84c7ef670a117ded12c899ecd29189a5a018eafa163a1642ea3db10ba07922", "object_relation": "sha256", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963407, "uuid": "b9e5051b-e5a3-453a-bec7-96edc34751b9", "comment": "Malware payload (AsyncRAT)", "value": "228d72641d3e7587f3769052efc1355a209890c8", "object_relation": "sha1", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963407, "uuid": "6dfde6ab-b40a-44ed-a300-f273e4a54fb1", "comment": "Malware payload (AsyncRAT)", "value": "8a74b548452e483b4f7ab4528cd93ff1727fd87b3c56b1095f78e05989a10fbe2f68ca128ed8bdc4afba74348b994905", "object_relation": "sha3-384", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963407, "uuid": "184cda44-afae-4597-8911-658d91791303", "value": "T1F3F24C083B904225D6FF7BF969B371021674F9079913EB8D4CD89AAF6F27BC045043AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963407, "uuid": "7b27afba-75be-4fb4-8cc2-fccc944f07ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963407, "uuid": "1f80eeb8-8bee-4497-be78-572e6b737553", "value": "768:W+LJau6SW06XP1xcOMWbFJ9Ymp+OMhK3xzj:W+lautWzXNVMSFJ9Y6+OMYZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963407, "uuid": "82918d9c-fd20-46df-b416-a6f0c1e23b34", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963407, "uuid": "1649f07b-ebd8-4b55-b74c-c77ca8e058bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963407, "uuid": "9c0677a7-85da-41ac-9a90-b8ed16f98f0b", "value": "yuyutest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e41a4dc-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937711, "uuid": "80469651-3857-4e09-9812-1b6148a0de5d", "comment": "Malware payload", "value": "95fe8ba959728ec0296287c559b42bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937711, "uuid": "adf9c422-cef5-4a28-9cb9-eec29fe28578", "comment": "Malware payload", "value": "3dcf1e45ee0ae78271af171bdb021e021682a30e24c0994a2cc81183d2eb6769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937711, "uuid": "39e38e8a-bb3d-464f-ae85-05b0d7d7fde9", "comment": "Malware payload", "value": "e2e6d8e6b10e59af9f618362f889ac5cf8be78a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937711, "uuid": "a15c2f19-c09e-43da-88da-8441e18834f4", "comment": "Malware payload", "value": "f4c2b019b4ea2f9ca091c524754b72d6ecd2342440fae85bb4e2105ff7017f16d1c69009b364b535e8403cb1e21be6c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937711, "uuid": "3e2b0efc-36a1-471f-a103-e39913178709", "value": "T1B2564A03FCA555E9C1ADE23089629253BA727C491B3123D72F50F7386F72BD06AB9790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937711, "uuid": "b295ba96-ab1b-4171-902f-f86e0c413311", "value": "49152:Tp5FOWm/W6TziAw3Z27/rziRcVghun3h6sH0df0woPSGU2L6ZddZTrbkVN26NZr7:TpF0rvMM3wo0JKSH7zwByukHEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937711, "uuid": "e5852518-2697-4688-ba8e-ccc305c0578c", "value": 6213816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937711, "uuid": "be6a0d7c-f132-4faa-922a-c86dc0f62631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937711, "uuid": "66170570-d736-48c6-b6db-a683fd0509fd", "value": "mine-agent-linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fc7d97-1123-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897944, "uuid": "9684d4e7-222b-41cd-ab2f-445e7b388e1c", "comment": "Malware payload (Mirai)", "value": "8d33284d0d713c22d1deab647ec0facd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897944, "uuid": "1d06acb4-e12a-4b7f-9ad1-199589fc955b", "comment": "Malware payload (Mirai)", "value": "3ecdc4793011b382c169a6e03c7db44fdbc86a8869ee60aeb7191ca60a263cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897944, "uuid": "53b73b4a-4380-4d6d-8acf-146172c8e2b1", "comment": "Malware payload (Mirai)", "value": "d6bfea43e3f50fdca69494ec8dcae5f458acf0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897944, "uuid": "569ec3b5-79a7-4f9e-a246-08216e2469c7", "comment": "Malware payload (Mirai)", "value": "b6143a68a4bed96c6be83fa8a533ac643f7f3830a343396c92657483e091f68db1277610cb8eb7372baeeaa5c2ce6a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897944, "uuid": "1d391e88-531f-4385-89cd-8bb469429f57", "value": "T138043B46E7418B13C4D6277ABADF42453333A7A4D3D773069928AFB43F8265E0E27A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897944, "uuid": "af550d12-0c8b-4666-8618-d8d1a9851cb5", "value": "3072:Rm43REIdFvS3bDpawRh0FPdmndXZuTVBsPTr4uK7GM/9FgM1HZK:w43KIdNS33pawRh0FPgndwTvsLr4uKKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897944, "uuid": "af06ab94-a3b1-44ff-b666-705c43347fba", "value": 180798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897944, "uuid": "c60ad418-2c55-4d45-85dc-fa7e749c9d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897944, "uuid": "83b678fe-60f4-4f33-a6cf-605d15d517d9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8550e2f4-1121-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897109, "uuid": "fc9f33e2-c191-4bc8-9208-58620d628d69", "comment": "Malware payload (Mirai)", "value": "bb588f95b0a4748efb1affe14f1daa12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897109, "uuid": "014e747d-2a8f-4a24-b921-4313c4a88702", "comment": "Malware payload (Mirai)", "value": "412cbcb1cbc53f9f19e285cacca51884f1a147456149be6bf3c872d09d2eb2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897109, "uuid": "7eb01e37-daf2-4d15-b773-700064631b8e", "comment": "Malware payload (Mirai)", "value": "2cd6f33d3dc76654095e100f8670f4ff46abb323", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897109, "uuid": "feaddf61-66bd-43e3-8b19-fc7e806cf7fa", "comment": "Malware payload (Mirai)", "value": "1140dff4bfa1095a5f17c10ddc42fd9565e271b240534b078695ed4bcd244139d2bd2c534c4fd58e50820cc2b7d1a119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897109, "uuid": "e8003b49-5dcb-4d26-9722-2d3b03724a37", "value": "T1CE233A03A5BC2E2BC4D0A63312B34363B1FA1B899194E64FBD650D4FAF543141A7B6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897109, "uuid": "414d900d-61b4-4ec0-bc17-8439e871c772", "value": "768:PnrJQ+o6L8mSiB/+2R2SQLg2Dt+h8GApq0ckmMdCtouyzVkMIZR5TE:PnNQ+PL8iBG2RZQLg2DQQYMdqymK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897109, "uuid": "34307c8f-869f-47da-93ba-eaaa950d4516", "value": 48808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897109, "uuid": "74d3b087-89c9-477a-86c4-34111d860992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897109, "uuid": "361f2217-154a-4ac0-b7c2-0a3ddceefc45", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86745abd-1121-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897111, "uuid": "af0d19d3-c210-4603-8a35-ebb958ab0841", "comment": "Malware payload (Mirai)", "value": "354bcd6fa9bf352c7d4b176a942a9068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897111, "uuid": "57a8a347-77e8-4696-8169-3d5a761f8d54", "comment": "Malware payload (Mirai)", "value": "4159629de81010128604061cc3ff0e38e83460d67f3b84312c77d85bb821933a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897111, "uuid": "442a1516-42cf-4d8d-ab9e-4ef3d21d3a7e", "comment": "Malware payload (Mirai)", "value": "ba8b213eb13922bce6506a572f93d46ca25509bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897111, "uuid": "7b6e0882-bb73-4481-86cb-aee46209f31d", "comment": "Malware payload (Mirai)", "value": "bd5a47efdd472aab4d787d117a96dcbcce38cf7a2854b6feacfaafdf7a98c10aceaa3e1d47dca7fe642ef224d3b25375", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897111, "uuid": "c80b008e-7802-4f11-b911-2aa426829a64", "value": "T1A2834AD7F401CDBDF84AD77B44530906B131E3A25A830F36226BBD63AD361A55923F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897111, "uuid": "8b8e0b03-f7e2-4e22-ab54-7ccb1661fbac", "value": "1536:TQ0hlWpJeCR33RAk4oKgpi02X/WN8Ab9M8iR2a/7pc3FT7X5FT96r4S:bsR3hACw02X/Wrt6/tcV/cr4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897111, "uuid": "9bc04472-f540-4c6a-b9fb-7f1fb760592a", "value": 85092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897111, "uuid": "b28b65c7-04bf-49b6-ba7d-109a755ed7ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897111, "uuid": "463e7489-9aa5-4902-875a-1b03ceff335f", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ee8123-111a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771893968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893968, "uuid": "a192df0b-ebcd-44f2-b3d7-6a4476c8b2aa", "comment": "Malware payload", "value": "54e3276e1913717cd687c03fb53f7210", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893968, "uuid": "a058ccee-c5a4-4f82-83c5-8135e9fb5f25", "comment": "Malware payload", "value": "4223b98131d864438313cfbcb2170a1a578bb5a7698f43f34cc19c4a6e76409e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893968, "uuid": "57762165-4dff-4db6-b44a-ceb04210b94f", "comment": "Malware payload", "value": "1608e4b577b22d7de4ce6aacbd8830ecb90b79f1", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893968, "uuid": "5963d475-aa9a-4af3-87cd-a15e00dde6c2", "comment": "Malware payload", "value": "44d314009f5441ac446d32e4a9d49741246219d0b95b4366f08e7bbed6e2db075e04357603f45ff148041245a04c0778", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893968, "uuid": "7935937f-ac88-4eae-8ff9-ced18f02cfa1", "value": "T1388412953719819FC25A4C7A6FC2D5CAA628BC528F17630332E1770F2C3539E15EBA36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893968, "uuid": "dd474b1a-03d8-427d-9b69-e2c1ee262637", "value": "6144:tNCsb8uYoTZlaUbdFgLV7IY43fSPSXvTsnXXhtcrl0121jf1Gcnc:tNCpuvZlP4Ij3fSPS7snhMFAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893968, "uuid": "7d39f74b-7a93-4dcc-a47e-b23167192b0c", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893968, "uuid": "7cf94742-b67d-4a99-9ed7-56e63757f43b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893968, "uuid": "a7adde05-6db0-4e86-b3d5-3afdfb07a87b", "value": "SecuriteInfo.com.Other.Malware-gen.30957.26653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6df928-11ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771957007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957007, "uuid": "33371b58-3d07-45f8-b4f7-c66ef9ae32aa", "comment": "Malware payload (AsyncRAT)", "value": "82b560a7dbd96df7fd8bc9c70da8f800", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957007, "uuid": "3ce6a262-9726-44ee-a969-dd0ee16ef1c8", "comment": "Malware payload (AsyncRAT)", "value": "436474df017ec5f9d021d52f0748733ae43aff1f698adecfa44164873549e91c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957007, "uuid": "fe4fa62e-ed3c-4d3c-8f84-82fc68529372", "comment": "Malware payload (AsyncRAT)", "value": "68d7696787eed9e9f00280f118a28ee8a36813e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957007, "uuid": "e832c5f1-8f01-4aca-a5a2-d7fb4f5f962c", "comment": "Malware payload (AsyncRAT)", "value": "b3b05cff251487ed85e11b63c13dae365b05cbc218000f57acf32f0eef08183597a29931fe26010a021531c2f7ac2cd2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957007, "uuid": "0924339a-e447-40b4-8824-ae6bb87f28e9", "value": "T195837D1877E5012EE4FFAFB05EF17262CA39F6236903D51F24D4028B1A2BA85CE516F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957007, "uuid": "37885d54-7240-4272-abd7-102be9abec42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957007, "uuid": "ddbce9b4-561d-462b-bb7a-239d9341a588", "value": "1536:/x3trKq+rGEmzw7IMUSUbP9LA0kk6JulM9zOELZB:/x31KqwczTbPWL2M9zOmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957007, "uuid": "2084622d-df77-4a8d-8ec3-49a0431c6d2a", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957007, "uuid": "15b27d87-19d6-40ec-a205-75361798a07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957007, "uuid": "2860374d-6b4c-4f5e-ac3f-24b62696ff9b", "value": "4HkLahEJ6cFr8hyp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1749f3-112a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771900803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900803, "uuid": "7f0a13b9-d31c-4f2f-98ca-75c1b8f79711", "comment": "Malware payload (Formbook)", "value": "026655fbdb0be0ab6818c891e74601ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900803, "uuid": "94e6d52b-2426-4276-a0b9-62986ec622f4", "comment": "Malware payload (Formbook)", "value": "43b65b7dcbb7cd8fad155014127a0ae8b75f6c922f7fbcb938a8f699747075bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900803, "uuid": "2ec70da2-47d9-41c4-8746-fabdd8418080", "comment": "Malware payload (Formbook)", "value": "b4967949e920213404413a2fad92f325e134bad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900803, "uuid": "2b6af7fb-54e4-4de4-94cf-6158d32fd3be", "comment": "Malware payload (Formbook)", "value": "6c0b75334481f4ed3b8a304bb2f1a839da4bf8f946a5000a5bbc6feb6d519a0c3e9753fb451e0d1b139bf95e328f9214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900803, "uuid": "d9c2f1a6-0723-401c-8ef2-9033c050a399", "value": "T1DDF4235669808D52C1546372C439CC688A3A39716E25F66E43BEF27B3C303C399B776E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900803, "uuid": "f3c2fa45-322f-4cb8-a15e-d88c651dfbe2", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900803, "uuid": "8046acc5-3fe4-4489-a763-22d6a07bd2a1", "value": "12288:Oz7hU5I5yuNHIgzSFKxWltRohBfSTso93UWRcqoRxj7xNq1qb+7YGzvTEII6No:Of+iN57Gtene3RGFGqb/GzAT6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900803, "uuid": "86a55056-ad8c-4f29-8725-500732cc4dc5", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900803, "uuid": "0ec55160-6e0e-4640-a2aa-e02152adb62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900803, "uuid": "484abaea-39b2-4dee-a46c-84e66cbedc82", "value": "SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.28604.15472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a3ae00-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937747, "uuid": "336ec4db-22a4-486c-a7c8-b3ab108885cf", "comment": "Malware payload", "value": "d59ee3223a2df591828922092ef7afc4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937747, "uuid": "cdfa45c8-5743-4cb7-828b-51e9a771a20a", "comment": "Malware payload", "value": "442cbdb88df8eb394c86dc2b3a4d042ca660d9b3d0c49d2e8c5e4361ac5cce9e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937747, "uuid": "9f8e4918-8815-47ce-aa2a-79f4350ea1aa", "comment": "Malware payload", "value": "9a9204f6c8283b7fe1193ae01c0b820a6d574830", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937747, "uuid": "673f7905-b431-456a-8a55-6aefabc1092c", "comment": "Malware payload", "value": "bcde95cc50e82bc5d00f8eaf6ad7ebc0eb36f27074f598d03fd87fd3de4c46b046b28273c03eccb0d517c0284f2be836", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937747, "uuid": "b0ab197e-2020-4e67-b908-062e5c95b4b9", "value": "T1F1A16172346E85B55788821BBE7BA2527564038F04013CFDB1FFC16AAF467CD5AFA482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937747, "uuid": "efbf24e5-8c55-451d-bdf5-ee88f1add6b2", "value": "96:y+8kf5ckvWluqlugu1W4wypze2qP7TqM22I9FJJUblNO:y+8kOkgukugGWNyVqP7UNLJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937747, "uuid": "b81e9e06-e0f7-4ebb-ba26-2a6cf3ce4681", "value": 4749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937747, "uuid": "ad610cd7-c090-486b-9953-15fefb6794a8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937747, "uuid": "bd7ee69d-c77f-4a71-a73e-f047bda24ddb", "value": "setup-worker.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1df14e9-114f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916940, "uuid": "5a82a40b-bc16-42ec-a080-3537911cc113", "comment": "Malware payload", "value": "5dc4478ec6514c5486aff3268e14b65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916940, "uuid": "01146c6d-49ed-4921-8468-6b00df7bf374", "comment": "Malware payload", "value": "450d6e2f046c665533836ba6280c2218edd715402e420f0d328545d83b1deb88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916940, "uuid": "62bfbd08-9b9b-4b77-addf-59247f153354", "comment": "Malware payload", "value": "b19fb56f58c9495bf26b0093dae19f2fdf265f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916940, "uuid": "40f48670-d4f2-42d4-abc7-c6e3b3595a55", "comment": "Malware payload", "value": "1b091315d6bc19538cdc3e89bd01d786dffacd8879cf9a0db50587c8cc3b9e0ba7d69ca66a1a4c15d67289310e4dfe38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916940, "uuid": "28adbfa8-070a-4d9d-83e2-0422b63499a3", "value": "T1EA369D11A3D504A4D5BBDB38C6569333D671BE825B70A10F059AE2091F73EA18F2FB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916940, "uuid": "b342c6d7-f985-44aa-8602-91a0a84490de", "value": "b9a80a228ea8b806f4182b54f54c0337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916940, "uuid": "fe17eb12-fcb5-41a5-8246-554d791fe7a0", "value": "98304:XgWK+3oyxlZM7TjLo38mAgtpNOgKWGUauCInSm4a4gz:qyxlZeT+AdWGoBD4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916940, "uuid": "ff4552f9-7f75-4e36-abce-7f9d4327c212", "value": 4880896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916940, "uuid": "2daf9fda-5079-4902-bd71-3e88ae9cdc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916940, "uuid": "84837f1f-80c1-402f-8f05-d3f6111278df", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ff11d1-1189-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1771941888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941888, "uuid": "76e1293c-933c-42c6-b86e-771a042ffeac", "comment": "Malware payload (MassLogger)", "value": "dcc82780b8d4c3fb7eb8df929df89db1", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941888, "uuid": "321ad486-753f-40b9-9ca3-822f145b3f76", "comment": "Malware payload (MassLogger)", "value": "464de5b3b675b8c9736456a1495cb066c01b2c1c7ef1e9a3fea1a0764f1a3276", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941888, "uuid": "531505d7-997d-40ee-bf11-f0fd870c552f", "comment": "Malware payload (MassLogger)", "value": "2e5e9a0309574edc6ee523a434b6e80a9c7ac398", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941888, "uuid": "8da7aa11-5cf3-4406-8520-2d638c77c03f", "comment": "Malware payload (MassLogger)", "value": "293e362478859f7b996408ebf640543e4de752f450c3d163533c190187944fe109277436676b2e19b4270dd30a883b39", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941888, "uuid": "ad55ebcf-846a-420c-84ec-1a915d34fb56", "value": "T10E3549BA2C13E02B26ED78104DBA46444CD5C6456E607C63B3B9AB3BD961DBF38A7D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941888, "uuid": "8440fdec-1bce-492e-ba43-13a3c867ff05", "value": "384:wctC7I4IPBZztIClWaOGqhGNIwVqIW2EP9KC87vNzUEA7SGZMQHB:wctAIjBhtKhG7TVs2E2vNwEAWch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941888, "uuid": "7e853e92-ead7-4158-af0b-5521dccd6e12", "value": 1152020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941888, "uuid": "ba8ce324-d898-4873-bb06-02027987003f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941888, "uuid": "5a702f0e-6d11-44b8-9035-b80e33d099ab", "value": "doc069036785490.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495de8d5-118a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771942105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942105, "uuid": "58e3a229-9272-40b7-a685-e0ae60e00f08", "comment": "Malware payload (RemcosRAT)", "value": "bb78d7cc25977679413728ffea776cff", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942105, "uuid": "de30b8bd-8c52-4bd9-afbb-f7c9bfc36aa4", "comment": "Malware payload (RemcosRAT)", "value": "473465354ba0fe10bedc5a6de58ca8a42ca8b9230530299578153a96fce724e9", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942105, "uuid": "76d9f536-04fc-4471-a2bf-7c4f007babd2", "comment": "Malware payload (RemcosRAT)", "value": "cb9e138e697e64d45b3cdcc59c55e569221cae1f", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942105, "uuid": "69d77a37-2486-420d-8ee5-d7274ef0bafd", "comment": "Malware payload (RemcosRAT)", "value": "9c03912661ca76cb1e3ce25587bbc470fb03e534ee7032a9d244ba840db31376fb2f634af151f415e93c597c67647886", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942105, "uuid": "b7cfed76-911e-4147-888e-cb135ae3b2c1", "value": "T1233516BC9A320A8252094EDACDE07581D99F88573957BA1CF20BE7DDE5FD625400CF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942105, "uuid": "80f9a50b-bb6f-4a7d-9338-491839fc1c62", "value": "1536:Ayyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyw:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942105, "uuid": "92aea7d7-c521-49f0-8a33-c479846c334a", "value": 1147675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942105, "uuid": "14929e93-e719-400c-990e-effd6c0ac369", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942105, "uuid": "292247c8-4d71-4daa-a993-5f8dac7f2c86", "value": "Productos de maquinaria.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c9e6d5-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917398, "uuid": "0d8b9ad3-29ad-4cd4-a205-11f180ea9df8", "comment": "Malware payload", "value": "75432d55f2223776d1b6b65144bf25c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917398, "uuid": "42cdfaa3-64ab-4c2f-a2b6-92546f2e8b27", "comment": "Malware payload", "value": "47d84a4f7ca8de1d21513b7a1bcf46e7e6698c99902e6912efafbec3bb71b629", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917398, "uuid": "e6a07ebd-a18d-4e30-9551-273902f513f0", "comment": "Malware payload", "value": "52ad7d0345faa207067b4551ec13621ebcc1b1a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917398, "uuid": "2a81cf60-1564-46dc-8b1b-1d926c3cc1b0", "comment": "Malware payload", "value": "44932aea773e83666688bda5bfab3418003359facf6bb37fa1a4cb5fb3a89af61c0ccc6a6df3e6c66b4123cd4e379405", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917398, "uuid": "b32930ac-a058-4ae4-b199-2cc771f57dcd", "value": "T1DBD3E9996FC4FF102EEF906A9999C0DFD67A51858029938211FF7C31DDA93F443E1A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917398, "uuid": "904dc276-da78-46a1-8447-6fdbecb0c09f", "value": "768:C8m/Z6sZjWsYuSwnckNuRc5pRFnoDVxm8xeLScFYHXwz04mYF6F2r:CPXZ6uSEYc5pRFO4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917398, "uuid": "0bfc4c6e-865c-4280-a40a-84d700a38f28", "value": 137043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917398, "uuid": "e173b984-0efc-4d81-b989-88a7b9bf73bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917398, "uuid": "a3bf1d19-8dd7-4602-9984-eea75d0ee99e", "value": "invoice-1645080830.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d46f3e-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771916685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916685, "uuid": "3306ce9b-2337-485c-97d5-046d446eed34", "comment": "Malware payload (njrat)", "value": "7f3c6bf16ec301311cab349ee08ecd29", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916685, "uuid": "caf63dbe-de80-4ba2-8a2f-bacbd0429040", "comment": "Malware payload (njrat)", "value": "498401b1a45eae776af5e6a5ca16fc13ffed0692ac0e35adce365622a365465a", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916685, "uuid": "dc028c17-9123-42d1-a770-d82d36be4d63", "comment": "Malware payload (njrat)", "value": "7790fa34c30d0470fbede72ae6a758969e2e0897", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916685, "uuid": "7bd42aff-a6a5-444b-94d6-91fd6142f925", "comment": "Malware payload (njrat)", "value": "2ee6499bca511a2116cf970b181ff25f63c5d5b490d20c11aa93cd34109034b22a8e1db780ff022bca3ea6d110ee9142", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916685, "uuid": "d58335bf-f106-4b30-ac7c-76f1c1051bb8", "value": "T158A47D51BD4E83AEC59A6C533D299DF53571921B362FEE51B0285280ECB28F3434E6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916685, "uuid": "7ad45b6c-b610-4c32-ad60-adf93fad55b3", "value": "12288:fPnonA3ZDt8RN4r3YtBrVBjqHcoc6rGusnsOP8DrjCy:fHJdI/rHVoc6rGU5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916685, "uuid": "bcde8428-0025-4033-ab76-2aab20264771", "value": 460811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916685, "uuid": "95e97d91-83c1-41a3-a1f0-1020df86a6e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916685, "uuid": "0f8c073a-8237-4219-83c4-b4c6f9171b7e", "value": "SECURE.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04042592-116c-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771929104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929104, "uuid": "2b4b44af-65b2-4140-b50d-d82992e4ff1e", "comment": "Malware payload (VIPKeylogger)", "value": "1b1909d7293eb01ffd23821c6af99ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929104, "uuid": "8e0501ed-f548-4222-9387-ec02178b6f48", "comment": "Malware payload (VIPKeylogger)", "value": "4bbdc2db8ebd024339f6aed105a8381599191a2568a1b27f2aab6b076df170c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929104, "uuid": "f3ce4813-3466-4b5d-8ca8-c3271ee045ef", "comment": "Malware payload (VIPKeylogger)", "value": "22fd90e25ff42b76049cc1740fa300dfd3c41642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929104, "uuid": "64f1a56e-aa7e-4052-882b-79b47f25aa8b", "comment": "Malware payload (VIPKeylogger)", "value": "358f91f32ea7f8ef29398b62f8c298c50a2a9a6a8e635059640884c1ed9f4784abd59f2a745ea4ce95e73919465057b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929104, "uuid": "1987bad9-2993-4a4b-a431-fd4b9003f4db", "value": "T106B4231323B55817C2AA1E759AA2929FEF3499862C38D6037351DF0C7D73391FC98365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929104, "uuid": "7f53756b-006a-47d8-be91-a4a58858e991", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929104, "uuid": "127d8eeb-f4aa-48b9-8f76-6cd8e8871699", "value": "12288:z1yDJNHz8S8A2AQkMl98yQWF1VSP0deG2eS:z1yDJNH/2fl9NTVSP0deG2eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929104, "uuid": "2ad5364f-626e-4316-964d-9cae26c4820c", "value": 540536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929104, "uuid": "069a93ef-db0f-4ff7-96a3-6f0104698564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929104, "uuid": "220ebb88-12b3-40a5-ab3e-ed7a2e5bed04", "value": "Neue Ordnung 2232026 .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c47b935-1150-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771917226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917226, "uuid": "6cecad19-b706-4c2c-b6cd-b37c5e169fa9", "comment": "Malware payload (Mirai)", "value": "0f9fa3961c8a3c394874623d6935b950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917226, "uuid": "8e5c510f-3a6b-4097-b7b7-a2a7648aa9a2", "comment": "Malware payload (Mirai)", "value": "4c6117b78b73272d2cc431a85ebd9644b515baea414ee676709f288b12b52840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917226, "uuid": "e20618a6-456b-4d70-ac3f-c4d3e0c5b215", "comment": "Malware payload (Mirai)", "value": "5c1997ffa6b885fba718b4a3978db6deec42da3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917226, "uuid": "e258fac9-406f-4078-a0f5-8edb60e0278f", "comment": "Malware payload (Mirai)", "value": "3c62eb9e1be35ce7b806c0a4611902e61b66e26df899728d96cad9443e70801249d1b126d2b253903919d1c657db1ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917226, "uuid": "55bc61a4-a573-4ecf-ad09-8969197932fe", "value": "T1A503E8C2F801DE66F817FE0E45574606F634EFA14B529E365387321BDC3A1998837E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917226, "uuid": "19c0cd5b-e483-4b82-9926-fdb3db6f9a66", "value": "768:yol0VzoDzSZFeGsmJFT2CqhdoSAac8Gau6B:V0V+AZqhza8GXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917226, "uuid": "f181a54f-a472-40a2-b2be-7a4cc54bdf1f", "value": 40138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917226, "uuid": "5e386171-437a-443d-bd89-5adbc997cf14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917226, "uuid": "ca6b5f5a-a06b-4846-9947-45792d89a653", "value": "yakuza.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f99cc6-1114-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771891501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891501, "uuid": "90a31ba6-e503-47ee-97de-1deaa46d14e7", "comment": "Malware payload (SnakeKeylogger)", "value": "3751ae70447926f0798a308a81a6894d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891501, "uuid": "e89d7f85-d45c-4535-bdfd-0d02405a3d26", "comment": "Malware payload (SnakeKeylogger)", "value": "4c6517552dabced261fee4b939a2c9f9f5863643c17c2051ac5038998305eee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891501, "uuid": "e367b07b-fa64-4b62-a5a1-89e8e2f2ecd5", "comment": "Malware payload (SnakeKeylogger)", "value": "2bac1c83f1f18bbb0e96758e40079e2df5f6c19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771891501, "uuid": "30d181d8-e791-438b-8ebb-71c6d2994b07", "comment": "Malware payload (SnakeKeylogger)", "value": "e4be7f574e320d190f4e8dda80c6fa4c6bebb53442adf60a08cb9ddcea49c4d541de124ee9472c6a1657e086efbd5d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891501, "uuid": "0b7fc376-dbce-4d39-b7b1-78d875fed0f2", "value": "T131D4235499C09915D29573308836CDD09A703831EC293B6E83A9E5BB6C79393EE53BCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891501, "uuid": "e3186fe6-b865-4123-a3cb-29120a4d0529", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891501, "uuid": "bc822df8-3ef9-451e-9bff-cffcfb6ebb11", "value": "12288:Pz7hU5I5yuNHIgzSFKxWltRohBfSTso93UjD/OyQiY4rZ2NUbUPvOB8Ys5Wisu/5:Pf+iN57Gtene3GrLYSMSbsvOB8YsHsuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771891501, "uuid": "bdfd88d2-2034-411b-9c64-f0fd45469660", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771891501, "uuid": "4734b9ac-2360-42fa-9d9d-149cb9be9091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771891501, "uuid": "6ca8a455-51cd-478d-853d-a739e501777d", "value": "rnewinquiries2_506_000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dbb9e4-11a1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952270, "uuid": "bd8d64f4-989f-4b35-ad29-0ca0f85fb7d1", "comment": "Malware payload (njrat)", "value": "6a9a249e061e1a9824ed92a5e656f6a8", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952270, "uuid": "a63443ae-da41-451c-8101-1aaaa05d0545", "comment": "Malware payload (njrat)", "value": "4cb3fc50e4ef660ef27482462cc0ab20df48af0dcd2b6c032262afe95e04625d", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952270, "uuid": "ab06c5ce-232b-48cf-84f3-2f156b5bde39", "comment": "Malware payload (njrat)", "value": "f7ea773d737641dd87071292cac628487d4abbd1", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952270, "uuid": "25c06ba9-33ad-423f-9d36-64b8c228afab", "comment": "Malware payload (njrat)", "value": "8c5a1d1d6e49a59e3c712eeb02b3bbd27b68442fefb016d4f1a42f821f87c4ce2b531e3f3ba17be28eadd468a3ff49b3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952270, "uuid": "fa73328a-e430-4f56-a0fd-ec2dfd02dd0b", "value": "T1F862C0B1E842DEBBE8C2A56104F45B73A116E11DBDBB261D5904EF3847A8DC009F6E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952270, "uuid": "f159153b-6fe6-4538-abf1-d9394aa6915d", "value": "384:nkMc4GFUspLGcra/trfBT+MMkUGZIs3oALRkItQs8rt:kMZGaqGcrCrJ6DkzLZL5Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952270, "uuid": "84b35502-7da4-49e1-b008-5542ea8543ec", "value": 15189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952270, "uuid": "c11d18a5-db58-4eeb-81f3-fddee8ac9033", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952270, "uuid": "1cb7fb98-bba5-4ded-8e90-4f19260dab9f", "value": "4cb3fc50e4ef660ef27482462cc0ab20df48af0dcd2b6c032262afe95e04625d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c262ab6-112a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771900905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900905, "uuid": "d73b2d65-d57f-429c-870b-660ad55d4667", "comment": "Malware payload (Mirai)", "value": "831f045dac9cfe91f940d308ce5f8891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900905, "uuid": "92a692b6-b781-4f40-a7bb-342204214d20", "comment": "Malware payload (Mirai)", "value": "4d012f4c6b905c0da5d04c1453f14bcf1f143020c26756f99a636824c1aa46ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900905, "uuid": "d35cfd1d-9c04-492e-a9b9-c698c75f0993", "comment": "Malware payload (Mirai)", "value": "b051626ee7bf3e02bc0a465ecb4192d75e168180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900905, "uuid": "a50d3dd7-5dad-4af4-8856-4ba3274f33f8", "comment": "Malware payload (Mirai)", "value": "9eb1a9a2342a36cf6e5fb4dcd3318ade0c598415009d99447772e0a8264b6a05a280f43f56ca995f44e91ea3b9bfb3a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900905, "uuid": "d9e1654e-f22a-45ba-a89b-19f981b51056", "value": "T16613F2FB822BE87CC47121F0923769E8F8F669124767671B85E8621958D7F231F20F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900905, "uuid": "ac30fa0b-1776-4354-abd9-6ad052858642", "value": "768:8Pe+m4qMdu95qSlk7hdzxZUoTcmPC02H3XBNk2pT5dkw9uCPPT18QINx0TnW:8PeH4q8dldLFTDUH3xy2ndN9fPp8JAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900905, "uuid": "0c149d66-63ba-472c-80e8-c06f5ad02db8", "value": 44752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900905, "uuid": "5a64a731-4859-41aa-89c5-f1ed8fd447cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900905, "uuid": "37a91533-9ccb-477d-840c-3b6e938911ce", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0154d591-1157-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771920080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920080, "uuid": "df4542a4-1b42-43ce-b251-635180bf5374", "comment": "Malware payload (RemcosRAT)", "value": "c0cca94d16dad09309b3ae0157c4dbec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920080, "uuid": "f07b4f74-f0ea-41ec-917a-1819c49661f2", "comment": "Malware payload (RemcosRAT)", "value": "4d962f79d0eee6f983e0c95227d99f5ee456a3dcfe522d43bc2d2b21eb2d54c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920080, "uuid": "bb6a7c08-5cfd-4b5b-b5e8-b889a1234e17", "comment": "Malware payload (RemcosRAT)", "value": "70294629cff4a873948427ea2c1394c807205a35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920080, "uuid": "b83b56ef-2201-4a12-8f11-b836cd542856", "comment": "Malware payload (RemcosRAT)", "value": "252018c497a482b9fe557be9dee02961301225a740363a776755e9a54b4565c3e80680d809952c1488f4c717c3f4cd05", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920080, "uuid": "625d90ce-f9e9-4608-9ba1-0b23bcf880b3", "value": "T145D5AED9E3C57696C6E3F60ED0B8720857F563F85D8D346DD8A6F86A79F73002281888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920080, "uuid": "4c1268c8-ddaa-4ec3-9ac0-3e747891d9a3", "value": "24576:bj/h0VuCRzQUQCAVCEmni47Apfo2wuAjt+0rX42Uc7gw4q/nY1rSGQnwPdO/XoqL:X/h0q0dYe/vw1vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920080, "uuid": "1baa56d2-3590-4a6d-9ad5-3dd1ba544f50", "value": 3004960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920080, "uuid": "5509c7fc-d307-404b-a7a6-97edc03e3446", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920080, "uuid": "279c4e28-5221-4774-a485-41808585b208", "value": "DOC020260223.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56d4b4a-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919523, "uuid": "63df2e0a-2f7f-4a43-9ff1-87d04f2d2066", "comment": "Malware payload", "value": "9a39bd34f202cd5cfc646b907dd6aea4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919523, "uuid": "8a3dca27-05e4-477f-a27b-87d00cedf5d0", "comment": "Malware payload", "value": "4deda09a9af43ad458a9a6a6e01100dd4b24b0e050a55142dfc1de8c74e30a25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919523, "uuid": "c35498aa-3747-40bd-aef0-b4e011e34195", "comment": "Malware payload", "value": "9e15ae64f26ae14cf0495bd518f8c82d95856d32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919523, "uuid": "80e20968-dba2-4f71-976b-f9374ef18557", "comment": "Malware payload", "value": "dcf9d66255e4d0a7fad4c736c660a92d155c1e25ff3e2e8ff26b4da6579247e5fa5bcc6817d65ce4996fe729292dfc2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919523, "uuid": "f373e70d-f361-40dd-9555-0fbf2b8598cd", "value": "T102D3DACCBF369D36DD02DB9062051CA26A112A614BD6EC9C8C8ABF790677F598C0C737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919523, "uuid": "6ad214f9-7a9e-4644-9c03-e901039947b8", "value": "3072:CPXZ7YQhfRT3tdQDA/xdzQW6+uXuuamn9LWtvh2t39hapwMjeElTVcaPoTlq09Ii:EPpwaX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919523, "uuid": "f10f920d-398a-4e0f-9fd8-8f3162f22198", "value": 136087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919523, "uuid": "dbc248c2-ac78-4823-8db7-9b1f34ac4879", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919523, "uuid": "bf8a8dea-af26-43a1-b7cc-e7a446b655bc", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e1ff7b-114c-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1771915598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915598, "uuid": "d3b1c1e3-3127-4b89-b10b-40f21b727d05", "comment": "Malware payload (AmateraStealer)", "value": "764aef5d4950bf6c2c3a55704ed899b6", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915598, "uuid": "6378d9e4-73ec-4b56-80be-8eee45319adb", "comment": "Malware payload (AmateraStealer)", "value": "4ff9f10bf76be2082daf1cb5b46aeb8cb5b6489f26916524b177a8de438ff3b3", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915598, "uuid": "17e9f39b-64d2-4e7e-b9a7-9608dad50535", "comment": "Malware payload (AmateraStealer)", "value": "5a43b30a7c227df90341081ed12ae291be72b429", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771915598, "uuid": "d51dddad-a0e0-4e8c-893c-4c46ecaadd24", "comment": "Malware payload (AmateraStealer)", "value": "171923da851c42ec5e1d0ddaea3d19088c57d6a2ca7a0cd584bfce74ac7680b89a648af466e527e772872d652ae9d79b", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915598, "uuid": "1136e93d-5469-4f84-b8b3-78e6fca07069", "value": "T165C612EA6DD780E5D88108B4A31B16DB13F291964ACD85313BC27805F5B2FF7606E8B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915598, "uuid": "f80fdb0e-046e-4aa6-bd38-6681cc401e67", "value": "6c871eb5afcc648e749d578ab8277277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915598, "uuid": "eae269f9-2771-439e-9339-aec7bcafdf04", "value": "196608:LeP4w4ohw+zP3+lYW/ylQ4ownHbw0bj4jvQN0TZ+f4uVDtX1nh807Poru/0c:qUO6lZ/ye4JH5evw6Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771915598, "uuid": "481bde66-c99b-4b4d-8e32-44f169a6c073", "value": 12405176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771915598, "uuid": "7efa8e74-343a-49be-b36f-35fe1afcdfdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771915598, "uuid": "50097a9e-b731-4a95-a33c-dc24c530b4cd", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68cff5f-11ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771962878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962878, "uuid": "187ac7aa-de03-451f-9c9e-6a4c6c401083", "comment": "Malware payload", "value": "55771f11407fca3c3bc92ed5240a153e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962878, "uuid": "368e6210-a18e-4a41-a0ad-0ab3c5afd1f9", "comment": "Malware payload", "value": "506d9a1fd8b8f9b2c67c14c42161fd2601528bb317bffb6596b71ed4f8d8b793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962878, "uuid": "5445cc17-9989-4421-b03f-759d366b9f2f", "comment": "Malware payload", "value": "4313a5158c9a55805752844098a482afb3b84dcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962878, "uuid": "8cdaa790-8277-4c10-9437-b6cdf1ed3ed8", "comment": "Malware payload", "value": "28bff9df7750b56eab9e16c8f469d3c6e707a74e5d2fc9ed41fa43636dd0b49a9437bc35755f2336e7213b4fa334f1e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962878, "uuid": "053d121c-9766-4558-b4c3-ba6a7cf386cb", "value": "T16E33B648FC84676A4BE1B6FBFB1843CEB72B0788B3D731124A3A1B6033C5B65657A114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962878, "uuid": "eeb5886a-a835-478e-a746-194107ccea17", "value": "1536:mjf1+qDUOulvQ+nozmReC4uu7JgoKshC6OwS0qx+:pqDUOulvQ+nozm8CWJgpwSJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771962878, "uuid": "4aa71354-b641-40ae-b3a0-f8c46999b119", "value": 50922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771962878, "uuid": "bdd4ac06-9458-4972-b114-bbfaaa6b253f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962878, "uuid": "12af00fa-d5d5-4527-9c3e-e142dc5da92b", "value": "yakuza.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6483a442-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917670, "uuid": "aecc1660-e5bd-4071-917a-3ada33b18a9a", "comment": "Malware payload", "value": "393b0d960d69640f1751be95c42b7697", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917670, "uuid": "f446f9d5-1c59-4f56-8910-9575f27d0dd6", "comment": "Malware payload", "value": "50b5b7f9fc9414d97d34c95889e8b2ae19e85454cb2e55a513c5a53ef77b2a7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917670, "uuid": "4ebeab74-a9f1-4093-ab97-493d4db73fb2", "comment": "Malware payload", "value": "8ff0473a1b7c82be1013eeb847a19c1596562fd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917670, "uuid": "0071fdf0-003a-4e4c-a31d-7800fb8e33ab", "comment": "Malware payload", "value": "805f3916f114f8ce534773334bd1811314f92510ba7a0ab78df6bb7500f465986f0648c3cf21e4c9f2b919a39f0acc75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917670, "uuid": "0eb4a252-116f-4beb-b1e7-c87678a8ea52", "value": "T142D3E8FF9045DF1967B43852FD826762016FB970A7A2F94810914269C4F0FCBDAB239B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917670, "uuid": "f335724c-4d21-470d-8840-61ec35b5d9c4", "value": "768:C8m/Z6sZjWsYuSwnckNuRIN1TpRFT3GxeLScFYHXwz04mYF6F2r:CPXZ6uSEYupRF64YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917670, "uuid": "abd5a233-1f68-41a6-bbc5-8b0025efce97", "value": 138974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917670, "uuid": "6ea43308-4cf5-44a7-9fd9-b9c4ea1748a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917670, "uuid": "73234d2d-d6fa-41ae-a85b-8ae535d31dc4", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be93623e-1185-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771940155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940155, "uuid": "9c10a8e8-18e4-4aca-8934-3645c65fc2ce", "comment": "Malware payload (SalatStealer)", "value": "e145efbeeff5ed9084bb11fdede4aec8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940155, "uuid": "af5ea647-6ffb-4b8e-b821-4e221f48df5a", "comment": "Malware payload (SalatStealer)", "value": "50e4b1376739ee9a3660c9ddb63fe070eec750a6ee1b1d9d82f68d1e6168af59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940155, "uuid": "18a184f5-a4b8-4723-ba56-b6c8af5b641f", "comment": "Malware payload (SalatStealer)", "value": "1eb4204c1a60555c623389582a5aa207e07da4a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940155, "uuid": "0e45cb2f-4b1f-477f-be7e-badfee7e230a", "comment": "Malware payload (SalatStealer)", "value": "390e88e7cb57fb8e6c9c37217a41a0d0754d476bb83ff755e1c4d50acf9af9cdefddecb326d9fdc3e561a2e50838053c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940155, "uuid": "5a9fff13-dec1-4a1e-b505-6a3fe9621459", "value": "T1E8E533E7C34488E4E5ACA7F0108295E3433D581A98EF36FD60F8158D88F497E6ADF661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940155, "uuid": "29ca741f-ea53-4bf1-b3b6-b3fbbed23d6f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940155, "uuid": "84031d4d-ba51-4f93-a6c3-2459473fee59", "value": "98304:5Zhr41C4HjAd8VxsNPSqCqXkd9vTDAgByPqMIbv1oDkB:5ZSC4HMrBITDAg85IeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940155, "uuid": "acf40316-21aa-4aa4-878a-776cddcb8afa", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940155, "uuid": "8f3562ac-1bd1-44ac-8f17-1f3cd8cd368c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940155, "uuid": "d0b931f2-a9b2-480c-847f-d05da4cd0eda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebbeab9-1196-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771947376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947376, "uuid": "15b376a2-32e0-4279-8546-116ff4c76c5c", "comment": "Malware payload", "value": "72f7c6d779306abc2bd9acccf92c4030", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947376, "uuid": "a9441d40-89e5-4791-a417-96c3d362ae8c", "comment": "Malware payload", "value": "50f59d746976e36abb5a51bb0f376034cd737b3f9133f4bbbf52ebb6a8da8392", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947376, "uuid": "45bb45c2-a8bc-405b-9f5a-cb3b77277573", "comment": "Malware payload", "value": "05cb61b3cccd5320f1522a6d3c2191a7a33ef39a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947376, "uuid": "2671b1e2-3938-4e11-bffb-0aefdfb07b8e", "comment": "Malware payload", "value": "533432ccf9bb6b6a2a8a740b096f594ec156dabe765b746b844c88df152b67f00d410f6e88c2b0df4da2abf9c16b7d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947376, "uuid": "02755822-e04c-4917-9b8b-fb0c5ec0fd66", "value": "T10FB5333C7FF87098B2C9490F09F1E98B4777A387A5185AA450C3E1F2A1A2D4FA913D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947376, "uuid": "9bbb28ab-40b5-48f3-b203-4506a2593e8c", "value": "49152:5rfloXUuD35RQ4Px1DJPz9ehGT/zE2f1ZAx47ztJQpo7F6CeULl9zqfNw1R:5rGXUuD3Ewxe2f1Zf7z2EACHx9zbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947376, "uuid": "720a0969-87e9-4824-9f7e-2083b96015e6", "value": 2350212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947376, "uuid": "99ca6bc4-721e-4e98-aa6d-de3105e3fc85", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947376, "uuid": "c6d00535-db81-4c83-8df2-24631baa400a", "value": "24022026_1357_24022026_\u00d6deme kan\u0131t\u0131.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f469d88-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903783, "uuid": "40762ef9-97c9-45d2-9283-01674027823f", "comment": "Malware payload (SalatStealer)", "value": "6f4d2ef74b0e2b1ddb8e3ce1111cd503", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903783, "uuid": "1eb96032-fab1-4723-a360-9452c8289288", "comment": "Malware payload (SalatStealer)", "value": "516d45e1cc0817936080b079dcc8dc49b0b8e2ace238ff6b2ea6c6967a1ef925", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903783, "uuid": "f80f42a5-833f-4a73-babe-88213517dc73", "comment": "Malware payload (SalatStealer)", "value": "f371901fdc66b46fb6128f3fb75ce20612635559", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903783, "uuid": "09d1c573-e21a-4aeb-bf6f-7f41f134e85a", "comment": "Malware payload (SalatStealer)", "value": "3479fadb5a8a9c7d6e99ef3db4cedc2b1a5688f31e7ffb4b0452b23ff2b10b6e1392ebc21ff2d048d20aac1fcd23f3eb", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903783, "uuid": "db61e9a4-a7dc-4d66-9150-7582633b58aa", "value": "T169E63383DD55AF4EE11A8470C5373B85224DE69E1F408BAFBB3A535E8DE8701EEB5180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903783, "uuid": "9e00b3b0-4012-4f67-b845-80479681dc14", "value": "393216:MN6jG8vbOR7volku+7KNWs1Vea8nJS+PXUsNi4vw53zrBneMK:yDRzolkbKcs1Vea8GABw53dTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903783, "uuid": "e216d80f-fc19-4072-bfa1-a7bc04866e51", "value": 14647793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903783, "uuid": "a5e29caa-61e0-4c42-9056-87be4b102f92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903783, "uuid": "184043e5-c58a-4841-849e-76577d3bf034", "value": "Atlanta-Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b288ef0d-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917371, "uuid": "640ab646-6edf-4727-85fb-4cc51b5becfd", "comment": "Malware payload", "value": "a093b1ce6400cb9c788ea7d1671349cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917371, "uuid": "17a50e7b-0df0-43ca-8222-f25b11736288", "comment": "Malware payload", "value": "51d2e971a3a2bb2ad43f141822fa4f20d248f1bb1a22446e7e7c237872cf98da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917371, "uuid": "2e49551f-f3d2-4ad7-9e1a-55c891568b90", "comment": "Malware payload", "value": "4c7b8fd5a5ddb984b8a1cd236edd65c35ea98637", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917371, "uuid": "dd60a48b-c6dd-4226-9021-554fe62dd553", "comment": "Malware payload", "value": "bc3a4b7353ae25ddcc05b4788ade078896d67a578437a4559b6f7abbcc6615fc152cd8dc45067dbff2fe85040885766e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917371, "uuid": "871258ca-5d9d-429b-99dc-d60d1227483f", "value": "T1BBD31A8C9F65DECC1549B1B4984D2C247DC12DA7D67A06AE9ECFFF812131434AE2E923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917371, "uuid": "b5e649ae-5482-46f0-a15e-17141467225c", "value": "768:C8m/Z6sZjWsYuSwnckNuRDxqpWskokxW3CDkqA3Sn3/iU50O2KpAIpFynio2kEkV:CPXZ6uSEYsp5FK4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917371, "uuid": "75eee8df-2008-432c-b17b-ea5221876c46", "value": 138952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917371, "uuid": "029b9266-a2c3-4417-82aa-41950c027fab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917371, "uuid": "74b5041d-0061-42f3-9a3e-7f115f051c97", "value": "invoice-1645080830.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c87934-1123-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771897883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897883, "uuid": "57a78a42-a4c8-41d0-949e-95ac96b6cc4a", "comment": "Malware payload", "value": "02b544672339676f4987372df054f3ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897883, "uuid": "dcefc7a0-d761-44f9-b20b-782f35812611", "comment": "Malware payload", "value": "5238cc39a251ce47c33c4c21996c84420e3703e6a6742cb09ddaeec027f46118", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897883, "uuid": "0214b537-3fee-4883-abe8-2e0dffe952ed", "comment": "Malware payload", "value": "7d70d32fad39060390339cd7ef4f23617aa3fbed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897883, "uuid": "02c3e426-91de-447c-b61d-06c13253efa3", "comment": "Malware payload", "value": "164519a1ae7156ab1f058611027df116ed5a88a2528c10f100b53c9829d65aa4d8225ee93ddd92d119d8648fb11e120a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897883, "uuid": "a853df08-d95c-40df-83c8-b88fdc8860bf", "value": "T1F7663A136A28EB0EE22422305CF2DA88276A5C8641D7E517B355F318E9F306D8D6FDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897883, "uuid": "5450d908-2e17-4130-9877-fdbb6478cca4", "value": "49152:daJq9TYGtGIbcAH454el2sop2AVVvDXOMxgiAhotNjNYghruHLpKi94x+7HH4t5A:diAz2pJ94x6n4jEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897883, "uuid": "eda31708-be99-433c-aa44-ef580a83205f", "value": 6488257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897883, "uuid": "60142659-ddc2-4b0b-bf2c-28521de087e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897883, "uuid": "1c2083e9-6b6c-488a-9a99-564437b1fbd2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1648547-11cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771971137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971137, "uuid": "df5c9fef-18d6-4992-b1e4-c26b4b99a46e", "comment": "Malware payload", "value": "45e8973b22d3711432f46982012def28", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971137, "uuid": "21d6cee6-80b1-436d-9b8b-d6679dea5489", "comment": "Malware payload", "value": "54af96c07f8504e0ed718e115661e38a8094398a529591d2c6776a137cb565a1", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971137, "uuid": "816023e5-161f-4749-9b9b-beaf6b26e45d", "comment": "Malware payload", "value": "ed874390d4e4b0fba5ddff57155a0d89b26d7535", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971137, "uuid": "d402abcc-0130-43e9-9517-f93b9e3d2ab5", "comment": "Malware payload", "value": "a03eccc72d55a67ed45c9de8754643e6a99cd084aac2199754007736c6693c93b29f95e0ca39968dd2f40a5ecd628acd", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971137, "uuid": "467df157-62c9-44ab-9464-c5caba53a661", "value": "T1B3A35B5F27A470F8D19781B9CDA14E46E7B338750AB0A34F076486DA1F237D2BD29362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971137, "uuid": "f2ae5e44-126e-4f03-9a4b-c4701f40a82f", "value": "d5d3a9260e368636ceb0a837ce1a14b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971137, "uuid": "1aa2bf45-214e-426f-b8f8-a57dad13416e", "value": "3072:jnPffdmX8W6N+ZTp0V8Mi14dN5/GM+q/7w:bHVmX85NgTiwKdvx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771971137, "uuid": "f0d8b2ca-329c-48fe-8411-f93d3b379efc", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771971137, "uuid": "cb75c4fe-d1b2-40c0-bc6b-fd4529c6c7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971137, "uuid": "f5b9c7cb-efb9-4662-a7cc-6cac0290528d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5494ef18-1187-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771940836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940836, "uuid": "8490846c-4b7c-4c77-bcb4-6787619b5d48", "comment": "Malware payload (Mirai)", "value": "91d1f4e5fd4d558e95437b4c645176e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940836, "uuid": "eee3f0ab-0257-4093-ad30-3154bfe65917", "comment": "Malware payload (Mirai)", "value": "550284b2b23424cb0e603aee47b1e3b9a6b4168b9891e2a32ecbb45cf3a26d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940836, "uuid": "c95aa23a-c7cc-4ee3-8b4f-621b70663ff5", "comment": "Malware payload (Mirai)", "value": "05c847cb4e091a941c21b8908a107d2bc0bfc7af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940836, "uuid": "64293705-449d-4cd3-b861-bcc62b686a9e", "comment": "Malware payload (Mirai)", "value": "002fae4542cf5c1fd6bcef8ba7b0f62ad41b14d09c0dec9e43f2afb8618c78b763713755cb1795fc96ac105455a475e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940836, "uuid": "3dd2a1e6-6d38-4476-bf96-a9fdc7d6a787", "value": "T1A6836C2B6741C9BAC04791F627EBA661A823F83E0A33704773E9BC653F218C55E5D781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940836, "uuid": "2666ba80-3d61-4bed-bdcd-4eb304a1d5ec", "value": "1536:rHL8u2nHRpTjxe2oeLOOtyrEOLywA7irlD3rZ/G3rlphai6wh7/:Pd2nDFe2oeLOOtJYyhAD3rZSrlphai6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940836, "uuid": "72f40257-6957-443a-b65a-4bb1b83a9650", "value": 88666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940836, "uuid": "8f29f466-ae99-4c03-a8d8-f9511bd94eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940836, "uuid": "dc388531-0458-4365-ac3d-0ffef9a83c87", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3482dac-11a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771955249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955249, "uuid": "79b08292-bbef-4a92-928f-d7f25e8f07b9", "comment": "Malware payload", "value": "395521b44650449148845bef6822b52b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955249, "uuid": "834c6dd6-3e42-4965-87e6-96f7a228e813", "comment": "Malware payload", "value": "55579e4308dc48c7beef2c475b6e29ea87f1c365ceaa2c8c2c72a13ba3064813", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955249, "uuid": "15d1cc54-fd8d-4127-991a-54e0f34939a4", "comment": "Malware payload", "value": "b0b6b52ace92bdf2d0170a35b6390977edc1bea6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955249, "uuid": "0215feff-1797-405e-9888-635df36c25d2", "comment": "Malware payload", "value": "c44ac1ff83b544fa960630d7ed3fda057e3e8f734b5ea8fa498008ccde00fecb00c253d030226f0fc86373523e960f4f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955249, "uuid": "ab9d9832-9fa0-48f4-8e25-1c4db425d034", "value": "T14BC548073C9348E5D46A9279ACA231B97E20BC3C0B32E3C71B447A7D1E76AD019767D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955249, "uuid": "fc751c34-7551-4aa0-9e22-847eec7ad543", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955249, "uuid": "b33bef4a-41f5-4d0f-b2e3-00d47c62db0c", "value": "49152:Tbu+KN9wMMzKTFNZ/385MnXAENEvqfx/CP081eUKBTsbbOO5x:TbHuWYrnXAENEifx/CP08IUOTsb5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771955249, "uuid": "9d551de3-8d10-40c3-8b0d-944f74fe69cc", "value": 2653696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771955249, "uuid": "469b4603-e396-45ef-a6cf-64ec5095de39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955249, "uuid": "15884a20-74be-4244-8c6b-fdb785565ca1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5445ae-1148-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1771913873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771913873, "uuid": "2cfcf198-fcc5-459f-8520-466da455c2bd", "comment": "Malware payload (RatonRAT)", "value": "51e4ec700cc69375b7e473153a39cd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771913873, "uuid": "f7374f4c-b1d0-4c57-9c05-ebf6aae6785c", "comment": "Malware payload (RatonRAT)", "value": "56b8e4292689848b5a010b19b9b0db4ac84c8a45b1359f9e4434f5035e23c7a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771913873, "uuid": "50821c07-7cfd-4591-a9b6-6aeb4f6a9130", "comment": "Malware payload (RatonRAT)", "value": "5b6f5611002c6f4f347b09738f7d4db23abece5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771913873, "uuid": "56dea1ca-1cdc-4a53-8d98-b18bc6976589", "comment": "Malware payload (RatonRAT)", "value": "fdf81a9537d364252881cbfb0a43ede23dbb778c458a2f8fc90cf9e1ba3c7c00af41af2f0d286c0d4f8f6985ccb863a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771913873, "uuid": "be289760-3978-4a02-ba46-59dbe5ded1c0", "value": "T11DF5CF117BD9CE1BD19F17B260B242521BB1FC41B353EB0E19A436E92CB3B086D1979B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771913873, "uuid": "b2fa05aa-5dcf-40f0-af34-af95c5406e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771913873, "uuid": "fcbb0094-37b7-4d37-9300-7cff6828aa7d", "value": "49152:7WotEbsHjkmiGWU5+5WeLGpMZ7iKPVbyvP:woHjkDGjYQeqpgmaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771913873, "uuid": "ffa7efd1-5156-4bcf-b030-ab4cec775439", "value": 3331584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771913873, "uuid": "d1004a8c-c65c-417e-aaff-2c007144f57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771913873, "uuid": "9b3372d1-ece0-46cc-80fd-d79d6481936b", "value": "Retractfixer2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8f24a-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937652, "uuid": "1ba8fc25-4341-4379-aa32-cfd49d430803", "comment": "Malware payload (Mirai)", "value": "c66bfca0cab3eb96f836a7f92ad411f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937652, "uuid": "db55da7d-f698-4d30-87bc-d106888fd73c", "comment": "Malware payload (Mirai)", "value": "5761949e5aa032c31433ab3efe97998814ba3830b4886ed0c23b391eb0d95185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937652, "uuid": "59e9ceb8-d417-4067-a6a2-55e538f7a311", "comment": "Malware payload (Mirai)", "value": "98f3c2e63cf4ce3883fefb3a2a23238a74431348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937652, "uuid": "c8bb4495-24b4-4c3f-bc90-f6d83a9ea26c", "comment": "Malware payload (Mirai)", "value": "0f2978aac6d0e8227e7ff92c81c445c3ed2af7224763373314177d16c2841d3ee9ee403fe47aa8607a5aa745fb29809f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937652, "uuid": "24627cff-218f-44ce-8926-11708f516f96", "value": "T1B8054C07FF805FEBC49FCE34856EC31700DDE49716C1A22A71BC8A9C7A9D25A4AD7498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937652, "uuid": "2f7825bc-5a99-497e-9ad5-9ac6bafeccca", "value": "12288:pD9RiajLqReuGFsvdYOI6Q5nRQ9YTHTqG2xWarRBd44Og360VdH1MLevn1TpaFSl:syTHTrcWK2ti6aNTeVS88OHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937652, "uuid": "16dfc0d1-b18d-43f4-b28c-e1a5eefc75bb", "value": 837240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937652, "uuid": "b4ddc2af-5711-421b-b626-f9befe5df4d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937652, "uuid": "1e4b486d-ef0b-4275-9d6a-70fa4bbd71ab", "value": "a2work_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81bb923-11b7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1771961699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961699, "uuid": "4d077476-c449-4dd2-91a4-ad5e80c5d3a2", "comment": "Malware payload (LummaStealer)", "value": "83eca34551435628b7c997e721280a9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961699, "uuid": "271b177b-76b1-47c0-9d33-fc43605dc233", "comment": "Malware payload (LummaStealer)", "value": "5786ed5c35dac3d70da2065ac0c74c3055fe2976a48f7381985cadf29c541d0c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961699, "uuid": "83299596-baa1-4618-8b4e-8b98121a67be", "comment": "Malware payload (LummaStealer)", "value": "e6982f7dd299d3e6d166eb67ed987c5dee4c46c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961699, "uuid": "d9b8719f-14d2-40b4-b7e8-b50c10e6fb98", "comment": "Malware payload (LummaStealer)", "value": "2711b7c677f5c266607507d40743f60925b7e5c21bfa32cf3b78d434fcec6d1267a7f6c8d06f875e7c4770ab6b6a6f7c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961699, "uuid": "e40c57b0-1fb8-4e33-9c9f-9a94e81b41d3", "value": "T18D45E14276DC47E1E5B609724AB1A31B6838BCD59F70829F32C8393F0D71A950F6A72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961699, "uuid": "c7bf093b-1321-409f-9e58-847289733c17", "value": "24576:5VV+94FideTH//9XvvmjaAhFKzsZd/MW7mZdJwK3l7:liWfVXvgGQnGPwK3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961699, "uuid": "ce3e6d62-0ed1-4dcd-9983-5d1fffcb5c10", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961699, "uuid": "6b6c937f-61ba-457c-9b3c-727d1407b91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961699, "uuid": "c3fc0553-f75f-431f-928d-0f402410100d", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee83d77d-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917472, "uuid": "b296a76e-e23e-44be-b042-0c6b4ea59d67", "comment": "Malware payload", "value": "e567faa38807e721cd021976f64bc155", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917472, "uuid": "fd014e96-7f26-4fd8-b08b-9aa30f7b51f6", "comment": "Malware payload", "value": "57cecbd3f3988c9d389049a5673c2b21d220b0fd0d66cee92f5181c7a4b02238", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917472, "uuid": "8c3babc6-5ce0-4e3e-a7b7-41e86e806b8f", "comment": "Malware payload", "value": "da7393891be79d9c535c842dcdd0d5549682b73e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917472, "uuid": "6b79883a-c43d-45e8-822f-38dbe6c1c711", "comment": "Malware payload", "value": "c17292630782546bb767b5f579c829ada6d3aa2ebb6bf7ba513238792b83081bafeec2d711688a3a3015cc33c6a2ff25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917472, "uuid": "db25f4fb-7680-4365-bcc0-678e46067340", "value": "T19DD3193FE27B65728FF1C0260ADFD707D1BAC9224F22A71951C268437953E680B475B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917472, "uuid": "41c550e0-4f63-42a3-903a-b60ffcce6883", "value": "768:C8m/Z6sZjWsYuSwnckNuRHqA0CPeUTPqQmu/f+J6Zv6OCWvaY2L0+d8y10bpOFzi:CPXZ6uSEYTpOFR4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917472, "uuid": "a1b4c094-75ef-471c-922f-f21757937843", "value": 136055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917472, "uuid": "b1428cf8-5251-41b8-8211-a95bdf53259e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917472, "uuid": "99e570b7-2c76-49ba-810d-5873162bbe6a", "value": "invoice-1645080830.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2e1567-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771960577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "d9e9ddd1-e40c-4001-89ca-b8a4087f4f4e", "comment": "Malware payload (Mirai)", "value": "cb9951b87ab7f677627db312295c640b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "92e5c7f0-3275-40a0-9dd4-1b9dc101a87b", "comment": "Malware payload (Mirai)", "value": "580a7c2f12ea46d587ffbe0cdce44f330d2b936073b7337e04bf8af4e9bdd541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "8ba42aca-5c89-4274-ad6e-e3bfa66d5088", "comment": "Malware payload (Mirai)", "value": "da9e87edf88fd0a50be9c4f14b8262e60a37233e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "630db0b8-b906-4dcf-aa04-967f075198df", "comment": "Malware payload (Mirai)", "value": "7586a059c3806f8891595619e411ca2a8238dd176481694a0197263e5d907d110524668cdb947f97065dbad96ddcd892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "e45d6de4-7e11-4f9f-9c94-eb5a092634e8", "value": "T181E33A17B4C194FDC4DAC2744BAAF53AAD32B1991238B16B2BD4AB221E4DE305F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "974fbaeb-f6ed-4fe1-9d18-c4eab30c0e40", "value": "3072:vX4Fu4LJ25an63OJ6bgYZE6aNjaHTgtICu98yqIc1VXSY:vX4Fu4LJ25an63OJkMTGsLIrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960577, "uuid": "21409eba-e541-44f2-9a14-46690883bd30", "value": 152232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960577, "uuid": "337e710c-4f1a-4066-8daa-d5d497a2b9f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "c9c6394c-7930-4837-b3fb-89b65c02b977", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379d961a-111a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771893972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893972, "uuid": "d1ff293e-2721-4b06-8607-a8c9dc1c9049", "comment": "Malware payload", "value": "7781fc877ea9874fbbb80af289614410", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893972, "uuid": "796e7549-f246-4aad-a228-7fc8a6a6c431", "comment": "Malware payload", "value": "583645562e40857a58e23be09a96c9451069902f26319afaf915616ec971358f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893972, "uuid": "d4576e11-4d1e-43f1-a756-1b55a588c063", "comment": "Malware payload", "value": "01f8ab463717e4601b94c50be4d1f4f746dca3b2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893972, "uuid": "9daddc55-6103-459f-9d62-9ecc75f3badd", "comment": "Malware payload", "value": "838ba8cc796ae72469b0f7b95f3968245c9842f759dc81002583c4b35eeaf8c05b32bae5709c6e2ac058a61760932c0c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893972, "uuid": "54f19666-d04c-425d-9cf8-bd2be4a2b145", "value": "T1D78412607619C35BCA07A87A4FD6D1DB9218FC228F46230A71EAB74F24342DE45C7A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893972, "uuid": "536e9114-ce40-448b-ac9c-da8bc1cb67f9", "value": "6144:ENCsb8uYojdZoxcYLV7IY43fJnOvDmsupfvmqeRBEd4a63XK4SFJD46AI7S:ENCpuHoIj3fllsElguOa6n7SFAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893972, "uuid": "adcfef0c-f641-4d5e-9d2b-992f493ac724", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893972, "uuid": "76fbdbb1-3b76-4260-8a21-5c05639c713b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893972, "uuid": "659d6ea5-95a1-45ef-8842-3fe8d152273f", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.10377.16641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362680c-1195-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1771946793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946793, "uuid": "739920f6-9699-4592-bcf4-878104b41958", "comment": "Malware payload (STRRAT)", "value": "1c6280ba06f4a9c3ea0b01b19f937660", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946793, "uuid": "209476f9-b2a3-463c-a6cf-85c7286ccab0", "comment": "Malware payload (STRRAT)", "value": "587263d7e6c9428dac519c4c9615284d017e697948f0efdeeb331bbf9dedf595", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946793, "uuid": "c895f5fe-549c-4fec-bd51-3e28d05efdb3", "comment": "Malware payload (STRRAT)", "value": "40d3889b439136569d355d292d2e8dbb3c112bbf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946793, "uuid": "90255ed0-69a1-441f-976c-a5dcd2ff863d", "comment": "Malware payload (STRRAT)", "value": "27fe158ef94baf3b9fdbf41f7a9cb55a015650ddfa930f920b6a3df21730f11fa696021ab4db8b7ee210688d2e7a708b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946793, "uuid": "850239b7-b237-4584-bedf-d335a40e9a5d", "value": "T123A3F8547B44D072E763B0B3095C921ABD74E5EF925461CF0EF0AC9FDDA9C810F62A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946793, "uuid": "bb54bd00-bd14-4b13-a56f-0ed14ac63115", "value": "1536:/Bgy3VI8QVzWjMFRaeA7OZJJsKvG+dWXqCUoEIU8:/qMIfRf0n7uJfd2bvEIU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771946793, "uuid": "f3dedd29-ef6c-4ec1-972f-1ef111085f6b", "value": 98458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771946793, "uuid": "f4b744b0-a311-4731-b95f-fdba1b782cd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946793, "uuid": "2735cc0e-9b9a-429d-9e93-c615b6cb8168", "value": "Angebotsanfrage.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf901093-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919540, "uuid": "cd987e3e-282c-4c26-aaf6-e382fb784cff", "comment": "Malware payload", "value": "d9940400c0b5530d4965a51c67ed8b97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919540, "uuid": "367d9f9c-076e-455f-9177-d7d9c6168937", "comment": "Malware payload", "value": "58ca3b5bbbe874c71af83139b1f3acb9387b780e98e75cdfc173a5096bbeb31f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919540, "uuid": "0106f9b0-596d-4e63-a9f1-d24cdf979c81", "comment": "Malware payload", "value": "dffff7cb73927158e0e44ce4153969b3613023d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919540, "uuid": "aa6fff7a-96aa-4321-8ed6-faa42484184c", "comment": "Malware payload", "value": "d34e77809e89ba1c214bd3192915fd397d2a2a04abdfc5c5a8ea947d1459dc0c2fb7d9124dbfefb095a3326307b6212a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919540, "uuid": "e1542b8c-c1e6-459a-adf9-e327388d6a80", "value": "T191D3D8E4A929FE663D700E621B353A114B26807F886FEA451F660D6D83BFD05ECDD0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919540, "uuid": "4f8dc993-203b-4167-baf9-1cc38a4e2c5a", "value": "768:C8m/Z6sZjWsYuSwnckNuRPc/YAsg/SgqSXE/iNkj/8Mvl0glpjbUFspOkK0KdURi:CPXZ6uSEYWYfkFspF4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919540, "uuid": "b4a98b71-7847-4492-8c53-75c541574af8", "value": 138948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919540, "uuid": "68076eec-974a-43be-9559-d24dd18d391f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919540, "uuid": "7e0d0792-4e09-4d28-b994-290462f075cf", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e7405c-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903841, "uuid": "0096aa77-2c5e-4e2f-a5e9-08ade637a536", "comment": "Malware payload (SalatStealer)", "value": "26f045eef2090bac817b5fd120d7cfde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903841, "uuid": "8318bcc3-9a11-44bf-b13c-458136917e45", "comment": "Malware payload (SalatStealer)", "value": "59c56c3952ac26dc47f0343cc837ed22b1b25c49154accbeb90c8c7cb3785960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903841, "uuid": "00021263-7a88-4138-be18-46eefadb550c", "comment": "Malware payload (SalatStealer)", "value": "e2ff45934417014490cb17e51e5b558721c7adfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903841, "uuid": "2f61fa66-ea12-424b-80a3-d720fea3a5b7", "comment": "Malware payload (SalatStealer)", "value": "4dde7d40e729487fa308f231378bd8eb082fe7f8cfa192acc9b9aee91342fc14cc7168f5103de19cf144b08e54df0f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903841, "uuid": "44cdd809-2763-4a7d-a328-40678ffdad1d", "value": "T131E53331E859F7CED1997B73998A22D81BB3CD7AD84685F029A4421CDDC66C83DC4B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903841, "uuid": "6d732ab8-ff3d-4962-92ef-117b34759449", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903841, "uuid": "e565b572-8653-47f8-b361-7805ecdee8f5", "value": "98304:atGuFIZ6N7M+K13FjFVEORpQxTcepooHDo5v0eB:d6N7M+KbEORpgpkue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903841, "uuid": "84018e81-5577-4d5b-8f91-68119a5ae884", "value": 3298304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903841, "uuid": "e452ad3c-948a-4eb8-a1c9-8f5f2ae2a376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903841, "uuid": "483fa730-1848-4c03-8f70-8aa17aea82a7", "value": "RobloxChatting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f2dd1c-1129-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771900680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900680, "uuid": "a2729d73-e949-46f1-83d7-3f3fdce4535b", "comment": "Malware payload", "value": "65bd8881737162ebe8a80350228641e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900680, "uuid": "68d8f3fe-bdf6-483a-8c96-4b9f9fafca08", "comment": "Malware payload", "value": "5a0f207f16effe4dc23342e284577872c0871f3cddf7b66ecc2ba9be7dfc6ded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900680, "uuid": "29c3b086-7c33-4c4d-b1f0-ade97c54b069", "comment": "Malware payload", "value": "e2641eba8bd43cac69857931178ab46c9527d568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900680, "uuid": "1433d6f6-2e62-4e95-8d4e-c4b8fb402fef", "comment": "Malware payload", "value": "d70de711e20a32e5e0f90e1789b5f82cf91826a2f08672dd9b42f8c23518b290f54f389e73a59f934be4f6eec06a6040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900680, "uuid": "a9544518-6ef7-45da-9b1e-f22b9cb49730", "value": "T105068D17FCE508B6C0EAA23289A751927B71FC490B2123D72F50B6782F72BD49D7A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900680, "uuid": "e427f5da-088e-48b8-9eea-6c581b7bf99c", "value": "49152:O6SNykyGW4/PenBsjUGba23HhVMFww59a8HZnDpvmafskON:O6/kRk7WMFvEsZnDlYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900680, "uuid": "85dce58c-848b-4861-b100-8b98342231d9", "value": 3693816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900680, "uuid": "a64668d7-3c18-4938-9a02-65c9537f0004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900680, "uuid": "f33554c9-0f34-4661-8e68-c9fa3e916651", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a6dbc3-111a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771893970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893970, "uuid": "e61dc4f4-099a-464c-bfe8-6f3a12193e13", "comment": "Malware payload", "value": "448cc0ea413db5fd3025a6d7a1eaed5a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893970, "uuid": "ef18a722-4bb1-4bd7-b644-81f947043cde", "comment": "Malware payload", "value": "5b122c2efee0cf9a56f5a4299870fa9a013d14afcc4d58fd892d8a12ff9039af", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893970, "uuid": "daafa504-c570-490a-beeb-9e4df686783a", "comment": "Malware payload", "value": "661e9abc20c6c42906f3f6f9de919b2a97cd4824", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893970, "uuid": "7d4d91c3-c284-4898-a15f-9940ec8af329", "comment": "Malware payload", "value": "de6e8ba224b45291a2d257fee27d9a2d5297e2f3af79ca9884b8f07294cdb282fccc59a67260ea4b6afcc29a199467c2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893970, "uuid": "d1fd43d5-3f37-4196-8162-13160900b666", "value": "T14F8412707B0D81A6C3178C7A1ADB84CF2624BC579F56AB0231D5B70E783139A16D773A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893970, "uuid": "f840abf2-57f8-44d4-b962-44f97b29f1f7", "value": "6144:kNCsb8uYoIWeRDGLV7IY43fb2jZoU2IhZyb4Bs9TGSdpDaJzn4Q6ypJ:kNCpuO5aIj3f6jGUBhwbJ96SdpeJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893970, "uuid": "46153eb4-e760-4229-98d6-54063719b052", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893970, "uuid": "5c24082f-ae76-48cd-8e32-96e821591c8e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893970, "uuid": "a6a878fa-6bab-44de-b0ec-c6733f050fa4", "value": "SecuriteInfo.com.X97M.DownLoader.2343.17288.7582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426716c1-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950254, "uuid": "89e458de-7657-422b-bf89-e2ed08396608", "comment": "Malware payload (Mirai)", "value": "d2143753c9ad66b770f0307ff292c3c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950254, "uuid": "86e3b413-d94f-4601-a712-898f8efc133f", "comment": "Malware payload (Mirai)", "value": "5b88163b2691c06fe71c93a64f7ec9755ce44a0e318c3e9e23134e0f4c74d5ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950254, "uuid": "c794b940-f1f0-4bc3-9be9-4d215835a47e", "comment": "Malware payload (Mirai)", "value": "b56969fdeb4159bbddd90bab39404ece0efd3016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950254, "uuid": "1dfa01c0-308f-4bc4-bc50-3f0f8ecd246b", "comment": "Malware payload (Mirai)", "value": "431feb2779d709f919d6e953ce18716088304daa19164dfd961d681b9dab0b816864e5512f5b3c812cac023d1f011610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950254, "uuid": "2745dbb2-8cb0-4c05-b01f-774dc86c7587", "value": "T12524A40AAF510EBBDC6FDD3706E90A4635CCA41722A83B763674D528F54A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950254, "uuid": "30287c29-e269-4fda-b476-8ff68af1b1fe", "value": "3072:I5pZ/kiJy74dMY3xqSSxMpIiBo1iXGkNxkahWA:I5pZ5y8MMxN6it1Uah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950254, "uuid": "4ce70daf-4261-4bac-99cb-fa1d14b2933a", "value": 224636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950254, "uuid": "d4754ada-069a-445f-b6cb-945c8c841e61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950254, "uuid": "79591fe8-626d-4044-bb06-dd7e8b462011", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf479d5c-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917392, "uuid": "1307c910-bbfa-4cba-a25c-fcdff8276302", "comment": "Malware payload", "value": "6e3d9bcd66d83f445edfe40368e95f7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917392, "uuid": "3d8f5c12-4dc0-430a-9871-03a782591c2f", "comment": "Malware payload", "value": "5ba1b676468b24e178c0317a5d9964211855a05a78e96c87c84d316b202c8802", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917392, "uuid": "3e5e6a9f-3ef3-4841-81e5-5149c46b0275", "comment": "Malware payload", "value": "736ac532778f195210d469dd0139f333f2cfda15", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917392, "uuid": "72f8acc9-b7f6-489d-9756-2825d849a99d", "comment": "Malware payload", "value": "081e62c0fc233ecf819ba5a12de0e89478ffa8fae0553db4ed317085c6dec3b6eb98838900d0ae9ce51b02db8af74370", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917392, "uuid": "1f3e7700-1a53-4034-abea-a648aea5726d", "value": "T14CD3D79852C344DF2EB7260A891414453DA9DBB7DB83363AF7920422F7D6E6E1C2F487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917392, "uuid": "47370bde-549d-4502-a835-0a52c690cd9d", "value": "3072:CPXZ7YSt9UWGRcXAfLCvCOEEzYRznUqs/vd+DrAWJDPzRAGKWs4CDDWYRgFygrsF:EHt9UWGRcXAfLCvCOEEzYRznUqs/vd+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917392, "uuid": "f5f72fee-3d7f-4fe4-a06a-08bb4a59dc71", "value": 136056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917392, "uuid": "d3645c05-6021-4b93-b5cb-ad78a3943289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917392, "uuid": "4ef81b0b-9280-4edc-b29c-2169e2413dcb", "value": "invoice-1645080830.pdf (94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076ea351-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917513, "uuid": "0a12b5ef-1653-49c0-affe-92a628601c9b", "comment": "Malware payload", "value": "107ee9ada0fbf46a4ce298bbe72793e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917513, "uuid": "09ff0036-69fc-4c50-995c-7c53ac3fc0ef", "comment": "Malware payload", "value": "5c2aba611ff600b74495064cd1627e42abea0360e03a092e3da0b0449f762b7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917513, "uuid": "ebcfea0e-32f3-41f6-885d-5dd6edba1c37", "comment": "Malware payload", "value": "3e9fdc6d420088366b6981cb1e4080003504a90c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917513, "uuid": "121075f0-83c7-4ddc-b636-59493c504e51", "comment": "Malware payload", "value": "09e3b52a376c466345bcc52635b7f2f84d49c47e440692752457c3aeca9b38a8778a36ec98c2b9e45a7e7b60a0b176da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917513, "uuid": "4719f278-c3df-4c93-a079-b1e53ab77874", "value": "T192D3086FE798492A15A8D616FC465E80D38B206C1D2138BFFEA1EC5094F7B08DDD14BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917513, "uuid": "a2825e28-b8ff-4607-aff3-b14438fafaf4", "value": "3072:CPXZ7YsMJqOPmnMgP/PyFIf7oSXv/pFPgL+Th+SonapfASdypSIic4sSIACGS2k7:E3MJqOPmnMgP/PyFIf7oSXv/pFPgL+T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917513, "uuid": "ba6c9e26-6945-4fc2-a500-aca314a11df7", "value": 136964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917513, "uuid": "e1175fac-eb8f-464d-bc01-a3bc3852979b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917513, "uuid": "735302f9-1a8b-431d-a6dc-167fe3e6a058", "value": "invoice-1645080830.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5617f6a0-115a-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1771921511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921511, "uuid": "2f857a7d-c0cd-4820-b638-8abc8bb65afa", "comment": "Malware payload (BillGates)", "value": "f24e46641789fa90f64644cfebfa1b36", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921511, "uuid": "0de46670-de09-4dbd-8aee-c37f5acb633d", "comment": "Malware payload (BillGates)", "value": "5c9f496e6f62fc29ec3545882baf9690ae82827486e8c7e434236db654109adb", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921511, "uuid": "e1be6ed2-5e0b-4d84-9e68-0bf5c614f75e", "comment": "Malware payload (BillGates)", "value": "03b1f49a63363cc660d5fbf5fb05aa3cdc91f5cc", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921511, "uuid": "454cb16f-cae7-4d22-864d-b4f3525e160c", "comment": "Malware payload (BillGates)", "value": "11cf9f75198f9f1b5a1eeaa6eb3b1e73de186ff4820c5fa33913a5beac8651ae31efa5868cd6c52bda3f562403eed25e", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921511, "uuid": "b5776d22-6e7f-4370-afaf-3ee7e41031f2", "value": "T1C1456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921511, "uuid": "dca4f8b7-f9e8-4e56-a555-9a9afab43659", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4a2y1q2rJp0:745vRVJKGtSA0VWeoZu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921511, "uuid": "c7694dec-0129-4737-a555-47abfc894592", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921511, "uuid": "ee2f19e3-fedb-40c9-ae04-c7c571b39864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921511, "uuid": "4be64e02-a87d-48b4-b6e9-cc63cd27cb32", "value": "kswpad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74a4ead-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917460, "uuid": "71facd57-42a5-4a09-8e84-044a48389ca9", "comment": "Malware payload", "value": "7c64027781c93be1af49fa2fef970c9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917460, "uuid": "58e46f3f-85f2-44a5-a18e-bf1895cac65e", "comment": "Malware payload", "value": "5d7b0163ed3eda914fd9a812e60190332aa61499cd2f360099f911bbf911e27f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917460, "uuid": "4d19fb12-2b2e-46cb-93f1-f2f2e9d02d2f", "comment": "Malware payload", "value": "4e8729fd03b6d25c6f06d35a8f54e8b8684a40bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917460, "uuid": "a3df35c7-8c6e-423d-8134-a2c77cbd91ff", "comment": "Malware payload", "value": "afb7eb8688bad5f625bcda7ef0a08e538cc2791fc20e94f8b96ba217e149a9a6d78f902d9de5a83b4d614c355f3afe54", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917460, "uuid": "771c83f3-1766-4558-a0a9-50a8820f4f3c", "value": "T182D3E9FAA77EF24A08580DBDD1AF65385083F6DEA9729C728E1ED2427F930C63043955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917460, "uuid": "a175be9d-cab5-4be6-80c5-27f7ef08a5cb", "value": "768:C8m/Z6sZjWsYuSwnckNuRWp36J94F5/xeLScFYHXwz04mYF6F2r:CPXZ6uSEYWpDFV4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917460, "uuid": "aa446fe1-041f-4a06-81df-c45f65ebbb99", "value": 138998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917460, "uuid": "f13e525a-fdf0-483c-83c4-bd9c4eb9ecef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917460, "uuid": "85031a33-295f-463c-84a2-fae7395d3233", "value": "invoice-1645080830.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fd9a55-1160-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771924034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924034, "uuid": "12823a84-f685-466b-9873-f11b8d47f86c", "comment": "Malware payload (VIPKeylogger)", "value": "15d60d904d3f3a471e38c40a4a90ec05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924034, "uuid": "e51a1334-51fe-4a0d-8585-103da3e434b6", "comment": "Malware payload (VIPKeylogger)", "value": "5e70b2297e5a00483901cb15f342af5d974c4662f52a64aa35586fb6b820aa08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924034, "uuid": "6431a796-a3c2-45e7-b85b-de8f530a9b9a", "comment": "Malware payload (VIPKeylogger)", "value": "b25588fab5edcb1006bf77bff1b8d459e3538f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924034, "uuid": "1dc2f300-6f7f-471f-a4c3-0475bcfdbe81", "comment": "Malware payload (VIPKeylogger)", "value": "ae4f5d1e4f6f07e3c3cfc33b12f01614a60236596ed2bb206079c282752f005f59ff8006ff17bcc2a64383a6bd0c1941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924034, "uuid": "e3649e14-1587-4166-ace9-fdfb5961cd0f", "value": "T1866423A6D747B2BCD0BF0ABB0FBEC50537D6BD05082CDE79DA7910DFA5516C0A869208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924034, "uuid": "b828b37a-5bf9-4f20-bd09-d5b9892cc208", "value": "a6575984dc975b0d1678d7d86b67443c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924034, "uuid": "31c101c8-aa42-4c65-8a58-69d228c0071c", "value": "6144:lwUgAb9c5v6AEOFPDIo8gqOaUMr+TsWxQdMABUO6BfetjZugoXRl5U:X9OyAEisz7rAsXd3mO6Bf8jZugml5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771924034, "uuid": "b465b374-015a-497b-b43d-8f8426754d0f", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771924034, "uuid": "c8af18a3-8cb1-48b1-91bf-bb82545c9907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924034, "uuid": "3ccc11dc-162b-40a0-81d9-b3de035490c6", "value": "E-dekon_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abe964c-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771921948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921948, "uuid": "2b43ab94-f2eb-432b-b7ea-7c0347dc26e2", "comment": "Malware payload (Vidar)", "value": "a01002541477a0db0e24b44f6033cdff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921948, "uuid": "bd20745d-30f6-4c2c-be54-046c823e19b0", "comment": "Malware payload (Vidar)", "value": "5e87b16aa971b9fa673e1c1dace691f9b391610eb3d51d50711536e435b43de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921948, "uuid": "271c1d41-b649-4bb9-8c2a-2ec469092a8a", "comment": "Malware payload (Vidar)", "value": "f2cb04f1899245b951e2616e4aa5f482fb516a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921948, "uuid": "41d2771e-c405-4e3e-bdd3-afc88b2d9d3d", "comment": "Malware payload (Vidar)", "value": "4535c9ac2c5cdd67ec4ac0580a592a1f38605e7de657fa93c7317b0cb0815d7952f7834a868a7bd91fdf1f81a4e6d900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921948, "uuid": "75b4cf90-208b-46ee-836a-f539cd750a9e", "value": "T15AE56B23ADD4C9E9E08EE234E8676156B7257C4C073233DB1E616EB55E363C06D3AB48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921948, "uuid": "93bcfefe-4948-4786-af5a-4ac0deb428ad", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921948, "uuid": "e499309a-8cdf-4c06-835f-b5b4ad0577b1", "value": "49152:tAPk0Fwnl4dmW6KV14qqa/8XwA0pMjX/8mtNP:t53GE+r/8XAMD/btF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921948, "uuid": "612044b6-18fb-45ee-ae36-98a052f261be", "value": 3270144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921948, "uuid": "f6a6e166-be81-4354-9871-27da69007490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921948, "uuid": "2950aa12-2056-48b3-bfec-4c9c897735ed", "value": "Payload (7)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1f69ff-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919345, "uuid": "92b2e525-1218-4842-85f0-2bc4befb0a8b", "comment": "Malware payload", "value": "4f36f5b5c2bd8d3a9957001b9f86345e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919345, "uuid": "34333258-bb4d-4960-86d1-4d08d5a8ce39", "comment": "Malware payload", "value": "5fe278caef515e3e23ddca4f2dc3c0cb004997149a32f4e8badfed62d4db115c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919345, "uuid": "abd9cfbb-281a-4ad6-bfa0-d1a155ddf000", "comment": "Malware payload", "value": "e4bbd033ed9b3a4208a97e7fcbd2914fc5e82731", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919345, "uuid": "fc172d3f-4b32-4e25-a4c3-15a450adcd61", "comment": "Malware payload", "value": "26af9187253ac496a0dfbc6ac3e3352c0da3b4c3235ca110eaac98981129741afdb0764aeb0e9d0c8e80d6fec7d86c51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919345, "uuid": "27144b7d-4d5a-46ac-88d0-d0acd6d30e1f", "value": "T156D3E8A21B515EA5F66A0035BDE133DDF531C4F4096B4463379E3263E6288D3AAC7BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919345, "uuid": "0d4234a9-7a67-4d80-897c-dbd98cab11dd", "value": "3072:CPXZ7YE7f+Ns3kaO8Bd5qFGssIX+QXbpZStDwqJBwUfeNcK7mMNeTYJZ5vZpE1Yd:ERpQ6X0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919345, "uuid": "78750bd4-3c0b-4adf-980b-a11d52b55dff", "value": 139891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919345, "uuid": "95706417-c283-46ea-9f9d-3dcd7260915a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919345, "uuid": "d3cfbd06-2861-4593-828a-3912b307b087", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a77dacd-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919478, "uuid": "d88cfddd-d5a6-44a2-b12f-776ba5432634", "comment": "Malware payload", "value": "a3b39c7f90b9c49640278a658f35d2cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919478, "uuid": "dd1f7259-e719-4690-84fd-0ac96c3fa95e", "comment": "Malware payload", "value": "60e9bcbbc831c45987b415a7b150c15cd432bba4810df64c073b8f817b60b900", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919478, "uuid": "b1bbdca6-356c-4751-944e-1cf75a917903", "comment": "Malware payload", "value": "2b131f599d821e989c81f98334193f4c38425c24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919478, "uuid": "1704b7e9-880c-4dfb-a939-bd38bb1f1dec", "comment": "Malware payload", "value": "4c46e86423de4d386140eb500ee622bfb8fb4e3964b07524ec859cca24d0baa3a9ddac97a7f9ea1049fe9a29304af1dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919478, "uuid": "57444610-be18-4786-9c60-11cc9e0d0e36", "value": "T144D30C99FCD8DCD1D230308D597A51EBC7167AA408A4F7378B87132BFFD8A14449A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919478, "uuid": "40aaa255-5479-405e-8d5c-19ea0357924e", "value": "3072:CPXZ7YQOq2/iRD6XE3DGepVZ6tSReCbGU8CQR3WJzcWo7uosdvCdTh5sCaZ1Xpoz:E8epDX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919478, "uuid": "04cf4766-d2eb-41c2-93c2-c55b67443602", "value": 137008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919478, "uuid": "f847f1fc-35fd-4659-a55a-a8d8af6afc17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919478, "uuid": "caa25b4f-2a2f-4de2-bf61-94f0e2428f55", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe52f0a8-11a1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952287, "uuid": "43abfa79-5711-4588-8f7c-3af6ea5e33a2", "comment": "Malware payload (njrat)", "value": "e167ab440fef4c39d92c78b40a049440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952287, "uuid": "ea33f7a0-ed4d-4167-a232-f43d529a69b2", "comment": "Malware payload (njrat)", "value": "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952287, "uuid": "2fb84ea9-e956-489b-bc4a-dfe827368b13", "comment": "Malware payload (njrat)", "value": "2e556829ca7de5fde15ac7b6f5c5195c0ec913dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952287, "uuid": "6e5f8479-42c3-4095-b2d2-277a6ff7aa6a", "comment": "Malware payload (njrat)", "value": "d266b41c9f85d9e54730dc815c3f8236be61401b5f278106526767cfcab6520495ed1d16374995e00bb5d56b2c893b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952287, "uuid": "430e8cd7-d12f-4921-a7a0-cba1a10603cd", "value": "T1AB93E84977E52524E1BF5AF79871F2004E34B4871602E39D48F259AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952287, "uuid": "57211c80-95dc-4b8d-8a4e-a5a0d86369ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952287, "uuid": "28f10ebc-eef9-4cef-a486-bb74e5cdc35e", "value": "768:kY3OUgSgmnldjcRoMwrx7Y+DIkIITJbXX0pOt8ux82WXxrjEtCdnl2pi1Rz4Rk3S:iUumlbrq+1NTZ0OojEwzGi1dDHD0gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952287, "uuid": "1ff7e023-5a98-4d67-afd0-95290aa6807a", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952287, "uuid": "2b1472c9-376b-414b-b58c-25e28c7fc0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952287, "uuid": "8ca46425-6663-446c-ad86-f4b97bfd3103", "value": "NemezidaLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40609ac9-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950251, "uuid": "0b3ce361-f001-4249-88ba-595129dae7c8", "comment": "Malware payload (Mirai)", "value": "db0bd0515aca626527edafaf67774a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950251, "uuid": "19d75866-1dfb-410a-a78c-2c09f56b604a", "comment": "Malware payload (Mirai)", "value": "62716ea1b599302bcf946b4930fb2d5f06528e6ad7c9f7ed09055780b91ca260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950251, "uuid": "4b596e53-cb52-4956-b94c-949b88e0c0ff", "comment": "Malware payload (Mirai)", "value": "d61f1052c7b278d63d3b4613d52e3d9711f9ab2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950251, "uuid": "482be8ad-68cf-4e5d-a769-1f19df511c5b", "comment": "Malware payload (Mirai)", "value": "c6c1ac3fa78b40f0204df0dfeb98d45ae0212abb245e74feaa3cb7d654acf774bc6f01d8c8ec21608a8d48e0b8db1897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950251, "uuid": "7f503e2f-5d2d-4e5f-916b-5225db701615", "value": "T1D024A65E6E228F7DF66CC73447F74A219B6D23D623E1D685D2ACC1101F2428E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950251, "uuid": "0a236013-ca33-451a-82aa-0116adf74c47", "value": "3072:fTujpnDQO5/px5RLIAYUZakD+beqdoOTg130kA9dA11nGAT/3Xhx:rSJDP/pf1IEZam+yqJ0Ek8A99/3xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950251, "uuid": "fd32865e-b006-4ab6-8586-67e7203e56ec", "value": 221308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950251, "uuid": "6e4689bb-b197-4958-bdff-8f8922b5ac55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950251, "uuid": "8509274e-eeab-4b43-9571-6a2a95ab8ffc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f5e5bf-11b6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1771960991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960991, "uuid": "b2074bda-021c-43f7-a40e-fd1cf7a8d3a4", "comment": "Malware payload (RustyStealer)", "value": "2c073e7b48f721b8c2e406deb2a43c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960991, "uuid": "c53bea2d-5794-4949-8305-e91b0b91aef4", "comment": "Malware payload (RustyStealer)", "value": "6290ff8d7a9a1553d55a188498d97aa8de62524d65dabc1bccd957bb96cc0622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960991, "uuid": "16c9e694-660e-4c58-beb8-577deae73c53", "comment": "Malware payload (RustyStealer)", "value": "d09c0fc304f168c9e3456b6fb5a5e8b6b4bdc96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960991, "uuid": "792add58-8cc0-4571-aa3f-a890b5719c79", "comment": "Malware payload (RustyStealer)", "value": "a0def992658dfe8070fed803d2adf29418b84775e33c8f8c9c8566486701b7c8725384a6220357cb9dc93535d1bbdfe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960991, "uuid": "3d048991-19ad-4e75-bb3e-7f5b427a22d7", "value": "T1E1555A03E2A985FAC85AC07CC7579636FB32B8894634A6EB27D44B343E5AF405F0D725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960991, "uuid": "1d83c3a7-720a-4290-926f-993ce441411c", "value": "27ebfb39205b68dd5c1997f7ab9214a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960991, "uuid": "1cbbfae1-3c96-4a3e-8eb0-3aa45e280f2a", "value": "24576:cjI7WGh86O28pzZlnIgT7f6+a74pxM5hZ122UdZ1:cjIaGm618pzZlnIgTbi4pxMjZ1q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960991, "uuid": "41ceb2b7-5cdd-44fd-8f4b-d65b8bd53e6a", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960991, "uuid": "60fb77b8-a5af-4143-bd31-67e57ce1fc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960991, "uuid": "1c51b305-e165-4a74-959c-66cf9357d6a6", "value": "smerd_alexei.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156ee49d-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937723, "uuid": "18bac63f-27d7-4f33-9899-17b460b8623f", "comment": "Malware payload", "value": "1a45cc405f3a653c0e0b38cfd9b69b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937723, "uuid": "0319ee06-fa74-4610-9aa6-ffd0db55144e", "comment": "Malware payload", "value": "635d49591254446f2fbaf88a5087fa6edb5c44e60c7ae826c7ce1ed22e35cc9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937723, "uuid": "93d9a6ae-b845-4f84-bbb0-ff9e8a6f4e91", "comment": "Malware payload", "value": "8edea40d0fbce6ac5d6f6e23f08e59327f2c91de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937723, "uuid": "2ff10a74-9db8-4bed-81ce-6c549737ebf2", "comment": "Malware payload", "value": "f1249935a87b674b390d8b12818cfc91c3687db5e3c7354f1d395258a5f2cc35a6595c8f4a743e419e7a86d54cffc597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937723, "uuid": "d88c3cc5-1a1e-45e6-b04f-98cf5a422430", "value": "T100664907EDA155E8C1E9E63189639253BAB17C484B3123D72B90F7386F72BD0AE79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937723, "uuid": "8dee8cce-edea-4361-8c1e-6dc79d049f5e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937723, "uuid": "2c6cfe35-2f38-4095-9e9d-1f8fb749888c", "value": "49152:usObj1NK02+9FOxBfnFyWUZm7XmRIKe2RNOTxL7KAYGne2iNeNNwMVgND0n1TfK4:uLL+/FmKKeQOTY40YBbKPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937723, "uuid": "8316a347-69c9-418e-a786-83849fae7b1e", "value": 6543872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937723, "uuid": "515c78a8-5350-4371-a8b3-40577e6a9b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937723, "uuid": "e6b60825-1920-4c8e-a7e5-96bf97f36711", "value": "mine-agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575e5b4e-118d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771943417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943417, "uuid": "c1230966-087e-47a1-87d0-c408f60efaf8", "comment": "Malware payload (Mirai)", "value": "7e19f776e81a98757c51a84e8fcdd2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943417, "uuid": "c5bd2c29-cc78-458c-a0e6-96f5a50943ab", "comment": "Malware payload (Mirai)", "value": "63deffbdd4053a38c95221589cc2ddd0595d451808a79432fa9f5476c4542390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943417, "uuid": "f10ec5db-44d8-47f3-886b-f91942a46fa6", "comment": "Malware payload (Mirai)", "value": "e8acf3722ef0428a5636f00fb25d23f6d1a58f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943417, "uuid": "f1e6b69f-bb21-4bcc-90a3-1c8a83d35d12", "comment": "Malware payload (Mirai)", "value": "55803febcd187dc2c06d068656a8aa06c603104bf6bcad404a7953a5d30e7895a4bc25415b9b2d19079de282f8f8fe2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943417, "uuid": "68ea1a56-6bdb-47fc-8195-cca9c396e1cf", "value": "T146831899B962C512C5E415BAA94A81DC330313ECC3EB3352CF11CB3639EE55D4E3AB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943417, "uuid": "bfa092ad-5596-4d4c-98f8-00d9a03b4ff0", "value": "1536:EphfSNksznRx7KAc9A8KKiEceJNsnxAglExkARGAkX7PV6LggIG:K6jznRJt8KKiEvNCl+kARgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943417, "uuid": "fc29be32-e4d0-43d0-8f65-844532220bb8", "value": 82164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943417, "uuid": "70ff28b3-f140-4ea7-b277-ca9f55a80d9c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943417, "uuid": "74386332-1a2a-47b5-b57d-09d931efbc4e", "value": "bin.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592c06f3-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921516, "uuid": "3d4ee1c9-52d9-432f-a9c5-f5104b0cf205", "comment": "Malware payload", "value": "0702e93b4516b6dda39b9410f417cb76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921516, "uuid": "1d8fd396-f2a2-407d-a6a9-7208da8081a2", "comment": "Malware payload", "value": "6600a7d1ab084c74f4b13cdeecaed30cf048a02e49e4411e27ab8842dc1c24cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921516, "uuid": "d61e232b-0ec5-41c1-930d-8d5dcc48a7c7", "comment": "Malware payload", "value": "881cdfe680cb41e28899e4167e3731913a5aaa25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921516, "uuid": "4fd0af80-bab9-42d4-a0eb-4f8bc0c40c80", "comment": "Malware payload", "value": "b6395350e758be99d3b796bccdb4018864088a6f05ee655e20cbcda1c602a5d72107ee7a5d923615aab753d69cf87b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921516, "uuid": "218d2ac0-ce5c-4a5c-afaa-8c1a3e47f5d0", "value": "T107463A276B58EB4ED72421345DB1CEA867391C4A82DAA527B345F30DA4F20BC496FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921516, "uuid": "ef339576-e812-4870-b0b5-6ae064af2960", "value": "49152:7fImWcIJ/PMjcme4PC6K18gx9Oy8XlIs99MbY0lp2sUn1Gd3plFQWSZvHH:lmzenA/6vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921516, "uuid": "2faa9a2a-c1e0-42b9-b981-8f4eecb5290f", "value": 5767168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921516, "uuid": "f154ba03-afb1-44a3-be87-229b79100642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921516, "uuid": "a8c10bf3-8918-4349-8ee7-332468703304", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133d21c6-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897347, "uuid": "63103cce-2843-4193-af7a-889e9fbc1150", "comment": "Malware payload (Mirai)", "value": "460105e2ef306ae818611977fd6a7e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897347, "uuid": "cc383ebe-af9e-41bb-9bd6-627e4c754b9e", "comment": "Malware payload (Mirai)", "value": "66544e0e6845406334e1e5dd9812455ee92b09ba75f2cd03926566685f43b2fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897347, "uuid": "659bcd62-715e-4301-8b67-f88bae62457c", "comment": "Malware payload (Mirai)", "value": "25ecf9c26926e44a55b8c8a4732d1878a780421d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897347, "uuid": "06942b5a-3356-4ef4-a869-f8d14ae97d8b", "comment": "Malware payload (Mirai)", "value": "2b2a39b4ace1e976d0a9a10ce306ec32a43673fdf67f15972d97de988d2a440e920fc803c67dd1c50cf2516177d4cd93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897347, "uuid": "030dcce0-2690-4453-9644-3274da29fe49", "value": "T1D8D3AD97F28B04A0C86206F013CB0F9E2E6321814F5BD5E37D6EA63B6E754DB1905BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897347, "uuid": "10935864-b708-4a3a-8003-cf23d019dd13", "value": "1536:R1vA3mQvW1HcyEpyOxncfFkOxZJDU1NJOlQQkW81x6U9grMn+/LW1:4tvByEp5xncfFkuZ5U1NIjkW8Pgr4+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897347, "uuid": "0977e4b8-889e-41df-9875-e443d6465140", "value": 132644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897347, "uuid": "d4c772b9-913b-4202-9412-f4220762743b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897347, "uuid": "ccb2cce2-2c6e-4613-9791-5593c8f0188d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3ecfb3-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928930, "uuid": "cb371bdd-7d54-434f-b5a5-44e97fafee85", "comment": "Malware payload (Mirai)", "value": "48a40ededa71c3858ee8a18868b50dfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928930, "uuid": "7c1022c5-e03b-4bef-9254-c3a2661bdd94", "comment": "Malware payload (Mirai)", "value": "67a192844d6163f6e800b49cfce6b9e4535f2cc1d184bb8a2271e8e47f4f268b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928930, "uuid": "443c1f8d-2ee5-4122-ba38-2efad189c180", "comment": "Malware payload (Mirai)", "value": "1ba2ed5233170d77992d25f8d3c0208b44781fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928930, "uuid": "90ad10e6-029f-4d61-92ce-addd8acb1f9a", "comment": "Malware payload (Mirai)", "value": "499759f20888b2385eb4321c20459086641cfb2c3319d810c6fc3a777fcf0b6619e2a2b1d02e0a4ee6d161da1826d088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928930, "uuid": "c54c4f8f-5eba-4e36-8658-9f9889e0aad1", "value": "T147A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928930, "uuid": "d070fa40-8aad-46d8-85d0-f50840e174dc", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjejNY0:lZzTJa1rZ62yqPy/ULWzjejNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928930, "uuid": "5c0ef837-859c-493c-bed5-590da52b3787", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928930, "uuid": "c011ae64-c1b6-487e-8a8c-070da2b97b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928930, "uuid": "b0b090b7-6291-42d5-92b0-32447a52908e", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fc4e6c-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921487, "uuid": "4965ea8a-2b93-4b64-a541-ecc60906baef", "comment": "Malware payload", "value": "1283eee6832fee2584192b373dec5e59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921487, "uuid": "811c9a44-0a00-4b76-8909-8db4759570ed", "comment": "Malware payload", "value": "67b06e97b95dceaeb248af08cd6ab3107239774708b74f976d2f049f28fa5139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921487, "uuid": "223850b7-f8d5-4362-a416-39a550bd3268", "comment": "Malware payload", "value": "4714d91787c2f6aab3dbaf4de8da0f3a211870f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921487, "uuid": "2dd7c304-c4ae-4aeb-b058-eb072caf88fa", "comment": "Malware payload", "value": "b3d55c8a446acdba00bb137749c75f07f4bc9425609fd29a9db7ee4b981c3da7bdc7e1674cbebb0f5c263651c9a635b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921487, "uuid": "6cdc4df0-e200-4466-a7eb-c1b2b67dfafa", "value": "T142362997B8924982C4E4367ABC7E81C473635EB99B9752576D04FE3C3BBE1A90E34700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921487, "uuid": "7eca6bd2-57d1-4750-8e6a-1ca22860f85a", "value": "24576:dO+nPUOHyGs/hVSYOzn/nuZyEy8DWO2FFWMCYTREkZHpjOlAA6518zm9A717GzS5:dj3Owhv6WSPo7ctxqNaL/ua4Um3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921487, "uuid": "4e545b7e-07bd-49eb-bdf3-6eca089bd802", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921487, "uuid": "c1213a18-0a32-48f5-b70b-ea4766eee2d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921487, "uuid": "eef8b800-6924-46dd-921b-e75faa7b756a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5f6e6c-11b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771962189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962189, "uuid": "c09f90c6-7b40-4c55-89d8-a6fe12032039", "comment": "Malware payload (Mirai)", "value": "177b2d64dd2b6aea97fbc72f15b5d4fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962189, "uuid": "578102fa-7052-4999-a2d8-5695e7693b92", "comment": "Malware payload (Mirai)", "value": "68085bc166b778410b1ba454e96b8c677a36bd4322d05fa5de1c14b4291d75aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962189, "uuid": "a5104e8c-b105-4d6f-9a97-a4ccfb624cbb", "comment": "Malware payload (Mirai)", "value": "690645f73ba401a8f5b18a305e50271f7e7ee683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962189, "uuid": "2c6228cd-eb0f-4393-b49b-2d59c30fac3f", "comment": "Malware payload (Mirai)", "value": "590e200fc68e902388329b9ff01c0c96e4ade8c1ac66ee73206b51d79a2d6dfc593f3464e8b045e31f222e4932333678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962189, "uuid": "590c4aba-b981-459e-9d98-a6a2fb35ec04", "value": "T1A4E33B06731C0A07D1A32EB43A3F67E093FFAAC121E4F644655F9B8A9571E361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962189, "uuid": "b7952f45-bdde-4407-8aef-fd0babecc01a", "value": "1536:t/ZfCj+Z9DasvIWkF3xfTIzEP9jg3hQoN7td4I/vAqjbzzuhdNpqOqkzhXqLR2:l3DsWkF3xoEFUH7j4Zqlm4L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771962189, "uuid": "e52bc52b-b89d-4f2b-a83d-31e2b9a4afa5", "value": 146356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771962189, "uuid": "62f7471d-a045-45a7-9426-92992a0d8e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962189, "uuid": "a57b222d-b6d4-4a71-8009-38a4a1a74512", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd25293-114d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771916127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916127, "uuid": "e065a140-1dfa-41de-9908-533589a0a2d2", "comment": "Malware payload (njrat)", "value": "37edca3cb744773eccea98375b22d03c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916127, "uuid": "58cf5d86-0753-4f83-804d-80210be68786", "comment": "Malware payload (njrat)", "value": "6846e6f0de97c7fffc720ca2f2b822a4780fac2f61b920ed067775504443cb8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916127, "uuid": "533d8725-f2e8-443a-ba9f-4a01de36a1e1", "comment": "Malware payload (njrat)", "value": "6d8f4f6036a15d3275d1d7376ab48fa6760c2d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916127, "uuid": "4c95bfba-4b62-48ae-b703-00369ed81651", "comment": "Malware payload (njrat)", "value": "f4dfa4384429f3073ad9fc0014a085e878e19fd1f757e23fd74c9ecc7b61674b0d5f75f20a291f377d96be8149f754c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916127, "uuid": "e0afb034-62c8-4736-81a9-66a346c82ea5", "value": "T138B33A4EF7604D68C22D0A7B8623900C43F5D2AF76A7F77B64D84BE15E224B889CB5D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916127, "uuid": "54f99fbe-81b9-4784-91e9-26a0614cc28e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916127, "uuid": "18509519-454b-40cd-b1f2-807183940666", "value": "3072:Eik3AqaGJe6B19xso0XxHWO/shCv+YeJZbov1qK:vk3Aqaoe6B1vsNtWDhbBXboQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916127, "uuid": "19b39c0e-9c40-401a-b3ae-b7a941937f1e", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916127, "uuid": "17ced24e-99af-4c16-a555-78348b021856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916127, "uuid": "482a56ba-56a2-45d6-ad8d-4ee798d80c85", "value": "6846e6f0de97c7fffc720ca2f2b822a4780fac2f61b920ed067775504443cb8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c586d3f-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919454, "uuid": "1e281e42-078d-4125-b708-999c3b26495e", "comment": "Malware payload", "value": "01c3f51308ac51eedbc75e31e879e528", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919454, "uuid": "5ad89e0a-66f8-4672-a2b2-8f1d7cfac0a4", "comment": "Malware payload", "value": "685a7da119d595c4b69e33cc012c77e93fb84764a0482ec2cac3cbbd621a4bab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919454, "uuid": "87495998-1289-41ac-ba51-ac930309b130", "comment": "Malware payload", "value": "e96db6f33b315a72dc78f078f40279df6d38e6a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919454, "uuid": "d7611b20-cbdf-4de8-af35-11bfbb91dfd4", "comment": "Malware payload", "value": "716c5c617b2f40c1c1ce13918dc7f79304d0dc266aa27de93f4817aff1fe09f0a1d3463eb7fe161e5f9ab610a6c218e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919454, "uuid": "695ee9e0-b98a-4102-a7ae-5ca51efb0147", "value": "T1A0D3DAFEC4743426B24564C880C95473B4BE11D2CBAEFB4ED09C98517B87B939937EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919454, "uuid": "d1c522dd-810d-4ecc-b715-f0c056b1bfa0", "value": "3072:CPXZ7YUamMp4C2YQUj2apbTwIu8O2OgAWJO2OHahcGouLZy/ZNQDyODSiGgO+lgO:EXamMp4C2YQUj2apbTwIu8O2OgAWJO29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919454, "uuid": "9353176e-a55f-4e8e-974b-a8bbdf8baeb6", "value": 138945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919454, "uuid": "7ef78a41-7440-4361-8da4-49a9cc0cdc1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919454, "uuid": "c65e5804-794f-44c1-b55b-39efc701dc7b", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74d917b-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919500, "uuid": "6fed9cb3-5550-4465-b837-067b2133d497", "comment": "Malware payload", "value": "d8416c794faf07c7367ef85ddcc66fac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919500, "uuid": "458fb6a3-a911-4cd1-99c3-63841e485a1e", "comment": "Malware payload", "value": "69862680f595b3d5c7188e6809f447fa674ff398ca6ce9068ed351a7ffe2b839", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919500, "uuid": "a028302a-3f4e-40a7-89da-42406b221be3", "comment": "Malware payload", "value": "1676f272e06973bf7524e25371e01a4125473b73", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919500, "uuid": "0b09a4dd-6c77-44db-8ec6-886c74bcfc10", "comment": "Malware payload", "value": "6884d9b99da0726f28bc9a4c4197964f6c6caf4824f9b74c29a1f3f5d293a7729dead2a128a1585320cf2d8bcce3a718", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919500, "uuid": "1d4ca841-4735-4730-b11a-92b4de28214d", "value": "T1F2D3FB0D431E2D2A03B1C54129E3965FB4EEAC990CB09A90B74EB958FE7ED77D8109CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919500, "uuid": "33f5237c-e53a-4f50-8660-955c35e01772", "value": "768:C8m/Z6sZjWsYuSwnckNuRoPFapCKW95r7m89xeLScFYHXwz04mYF6F2r:CPXZ6uSEYiFapg4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919500, "uuid": "155dc255-e561-4c51-9c11-8e71c2d1b975", "value": 138923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919500, "uuid": "6c3d868c-415d-4c07-bb43-c7a314d451a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919500, "uuid": "35e113a0-b68c-4984-bb34-911afee87e7c", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bd2c4a-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896600, "uuid": "3d661144-db91-4b1a-9229-80804815c88c", "comment": "Malware payload (Mirai)", "value": "57ab93a7a0c3c982e04b59fdec7f344e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896600, "uuid": "71371c40-8735-405c-a986-d883c85f8414", "comment": "Malware payload (Mirai)", "value": "6a013e9b052b12fc85ff93fbdd47a80afdb4f4bb9241fbdcd506b565f1b4a74d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896600, "uuid": "b184835d-c5b4-4c6c-8be2-6e997d169e7a", "comment": "Malware payload (Mirai)", "value": "4a3c213fb9254311bbd33ec5e289cb939cc94a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896600, "uuid": "cee886ea-c7ae-4c0c-bdac-2e638b1fdd82", "comment": "Malware payload (Mirai)", "value": "d6243e019a66eadee0be89c6532dbd74c71571fe064c01a2575b83a397b99fde4549f5829216e8ba41223b5af70655c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896600, "uuid": "f7a9efaa-93c1-4a75-b839-94eb326e4f73", "value": "T1EC735A17758084FCC489C17097AFA23AD973B07D0279B19AA7D4FE22BE8EE501F2D585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896600, "uuid": "d410cb8b-91bd-4843-b1e9-7882da7ba451", "value": "1536:GybnLlE+jvJfD68Ttv2AofeBjSIjZtMuG1NMeyXUb/pL64PXMc:dbtjBRTteAofe4IjH1G1NMeyWpL64Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896600, "uuid": "da1281c7-4c13-4995-b5b5-1fe0bc6f6017", "value": 77024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896600, "uuid": "a543392c-7b0b-47a5-be9f-a84c8a382b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896600, "uuid": "a496f0c9-e641-4d72-8db6-14e4138ba38b", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e078e55-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950247, "uuid": "b75cb929-bacb-44bd-a0a7-306da91882cc", "comment": "Malware payload (Mirai)", "value": "4a072563f31f58f1ee50eacb02c947bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950247, "uuid": "ccb431dd-2a36-4706-a6bf-6a7ffbf628b3", "comment": "Malware payload (Mirai)", "value": "6c0622d1ef6def5dcb50a1b9ad6e6f50961856664a1688f1f9c3b59c28653a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950247, "uuid": "eb92b3fc-736e-44be-be77-f5c6a514f9d0", "comment": "Malware payload (Mirai)", "value": "9660d62462fb79d837a66de5001b8ed784a63a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950247, "uuid": "fe996b83-1173-43ff-8f96-ded86e5ed087", "comment": "Malware payload (Mirai)", "value": "fd2ad544724005e27b2435ce140431112b2c4a8ab3d0f6400de813a12ebbd2905fc0493eae34a4c0551c20432ea14c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950247, "uuid": "dd2ecd90-ea60-4dc4-af85-585c15c799ee", "value": "T116A42A89EFD85B1BC29527BAFABA075FB3328A4577E7A115893012743FC27587B27100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950247, "uuid": "b2d78bda-98b2-41c5-91d9-1eb233d35f19", "value": "12288:OskO6Xq+AI14wlLoWwsN1aL8PHM92le+9hQ5N/1:OskOTZI14wlLoWR1Ujd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950247, "uuid": "2496b6c8-518a-485d-a539-e31f3e432a3c", "value": 458843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950247, "uuid": "0ced1612-5868-4858-938c-04a01453baf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950247, "uuid": "4b7fc84e-c42b-4cca-a9f0-3e1e14708d49", "value": "arm7_debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cfda6a-1149-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771914456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914456, "uuid": "59745524-77cb-450d-b60a-0f9e9ed0cd03", "comment": "Malware payload (ConnectWise)", "value": "216690eaafeb74e9a6ffe3765eb5971b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914456, "uuid": "31429fb6-6a0b-413f-9a4a-336ecb5abce1", "comment": "Malware payload (ConnectWise)", "value": "6cd3759d75c84984077e1593d3eb86a756fca1f87dfbeb303c74137f5f082103", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914456, "uuid": "d51c2281-1b3a-40a6-b81f-412230e47ca8", "comment": "Malware payload (ConnectWise)", "value": "db6e9c587879732a5b54ec8f4aff0e7996c39be7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914456, "uuid": "16dc54fc-24f2-4139-be56-bbeb084d20b2", "comment": "Malware payload (ConnectWise)", "value": "874846c5d166b05bcae230ab3e6aedebcd69bf00de1509e1465c127766a3180c44c4ff84969fbe126097ca17a8d71293", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914456, "uuid": "299c543c-c4b9-4674-943b-24b56ebf8af3", "value": "T152835B53B5E18476E9720E3118B1D9B4593FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914456, "uuid": "245c36fc-ef5c-4ca4-8786-363286ebb4f9", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914456, "uuid": "403a3798-923a-4e91-aadf-7f4cf8ea0496", "value": "1536:zoFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYY174Hz:S9q8tC0C+axfdalBqRfbYRGYYY1wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771914456, "uuid": "553fae2c-d624-4a7e-a4a1-d097260c4c49", "value": 84224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771914456, "uuid": "19e1fa03-6a39-449a-a504-407ca4f1ec47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914456, "uuid": "c8027682-1a70-4602-b0b6-382403b0e997", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f45a43-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939174, "uuid": "f3cfa7be-7511-4580-9fd0-07ace6bf3546", "comment": "Malware payload (Mirai)", "value": "7ce3fce7e816e0a20593a06c615118ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939174, "uuid": "ce781fa2-4ea1-4e96-b1b1-f42fc7d7aa9e", "comment": "Malware payload (Mirai)", "value": "6cd6715031639ca538d569694a664434769772cbc2ab498492d4cd70d3e93442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939174, "uuid": "56ab2682-38ff-4663-bdef-750dedfdb90a", "comment": "Malware payload (Mirai)", "value": "297941fd6f84cf470470638d9000d28c94ad8c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939174, "uuid": "a3f828d9-37a5-44c0-91cb-973d4a2e6e68", "comment": "Malware payload (Mirai)", "value": "66d85777a629c4941a73914ec0d0a3d9bced0e1f53023e43d3cbd71ec2a56fba83c6152df9d04c1d86b37a3bd66e70a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939174, "uuid": "dbb267f1-0b24-4ad6-8f5c-37b93ffb011e", "value": "T18ED35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939174, "uuid": "e1a3f763-80ed-45d9-a686-6fad73806357", "value": "3072:oWGIf1/UwfhJdU80r2tbYUaDGMsMA9TKtt:oWxN/UUDGibYUaiMsMApKtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939174, "uuid": "da258bca-5615-4d73-b5b6-285264e8a7f9", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939174, "uuid": "536e656e-d6ec-4835-9c54-386287531c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939174, "uuid": "cdfd87eb-cf93-49a3-867d-f7d7d05234d2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192ff160-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919261, "uuid": "e798d95b-f8d1-4dab-8b88-f10bf3f6efa9", "comment": "Malware payload", "value": "343ef3cf04d33d26b1eb919141b738bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919261, "uuid": "46c8229e-400a-4472-99e8-34687e8003f7", "comment": "Malware payload", "value": "6ce46990575191356379cf1c3004b3c9ad8b8f185dee2305c44659111345bf1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919261, "uuid": "7bf40ac8-f917-4587-a048-b56e223c18e8", "comment": "Malware payload", "value": "a15b3d03dc462c234a8e433193c8ea6d4a11ef29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919261, "uuid": "784c01fa-9ab4-443a-846a-1b36da3a0a60", "comment": "Malware payload", "value": "142f50d127ae70ee29c7f0fa57206ee0c5fe277221eab3d0f7aff8aaa816a0fbac4cb2d7b4d6a0fe840703cdc887219e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919261, "uuid": "1b6eb93e-27d7-44fb-ae41-7a372b086107", "value": "T1C5D3DA376F02BCD7F65C14BE4D3012EB92646B5B0692845F29CBB5C5BBF8111CEB0A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919261, "uuid": "de7ebbf7-d98f-46e7-8902-81336f71bb18", "value": "3072:CPXZ7YYpyIR4N7uTZXmRWTcw3RWwR1i12RJ+ZfmrMRRRnqoQpR0LxgoaZWJWCvGx:EZpjCX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919261, "uuid": "8bc622db-18f6-478e-b073-05028a4f522d", "value": 137964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919261, "uuid": "64eaaad1-b096-4ec1-8429-5bcc692b654c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919261, "uuid": "eadf5534-6fc7-44a7-adb3-05fb4d7a522b", "value": "invoice-1645080830.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680bdf28-11b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960196, "uuid": "e3f54d4e-d1d8-4d1c-b64f-fd100207bc2c", "comment": "Malware payload", "value": "619c7c873ff9e829e27e32284a10f032", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960196, "uuid": "37c57dba-6f39-4ea1-8dd0-5108f3ecfb60", "comment": "Malware payload", "value": "6d1b2527b1739a3fb62120722ed9c9111574b4077da43b892ba0940f8d028336", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960196, "uuid": "b51b983b-3ed2-48df-99cc-d528de4905c6", "comment": "Malware payload", "value": "86b3eb99676b60bf2dc8d5e75652651dd9d33852", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960196, "uuid": "16721c3f-e891-4296-ac1e-b96b8c6477c5", "comment": "Malware payload", "value": "52117ba2d282148dbef88c24c5e07b48c03f2a54adaef3ffd4d5e557358f167c8da10d68ddbf9e9f3cec97ca40f19e83", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960196, "uuid": "e096a2ab-7ba2-4b29-9f75-0d16a15f51d5", "value": "T1ECE633353F553B89C6926D36AA41F075363B8E20995BB366F2CDB3ED426A4269FC1C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960196, "uuid": "8b57d95c-04fd-4f7a-98de-d3d88e2924dc", "value": "196608:Zx0XqNV6ZuOuh8EY9rgGgNBX1eVhFsRkkbLSDeELoAGLUUctTPrT7GwthFPKKy2b:ZAqM+YruXX2hq5bLSyZdctTPrTSCh0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960196, "uuid": "bfd4657d-96fb-44ac-abc4-b769defc175b", "value": 14573568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960196, "uuid": "e17ec153-8ee6-46e0-903a-d70e5609be97", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960196, "uuid": "00e10f17-52ba-41ed-a709-579dc8189074", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db91b315-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937626, "uuid": "478f541e-984b-4f2a-84f0-5397da29d422", "comment": "Malware payload (Mirai)", "value": "bc5922cf9f59fda11ed167fae7dcc777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937626, "uuid": "ac1d75ec-80ab-43f1-a915-1f6b7fb3fa55", "comment": "Malware payload (Mirai)", "value": "6d6c5c9bd70274f0af47a66fdb88175e86504d600ebe16e2fb9fa4c5a988e030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937626, "uuid": "b8e6f827-7123-407d-b9f0-283b8abf4c6d", "comment": "Malware payload (Mirai)", "value": "25ef499d1d45c908bbcbc9b3d01f7c0e961a94a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937626, "uuid": "4d5a4e25-99ff-4d99-b79a-9affe931167f", "comment": "Malware payload (Mirai)", "value": "ad97ca267fcb7ce7691b1578135fa1fd31e974ba204ee32640e687dde214d2554d1125f02e0786f65ecb9841cb0fd364", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937626, "uuid": "66175736-34db-46b3-9b00-098296f9fc2a", "value": "T124C43A59F840DFA1C6D02576F64D86AC33174BB9D2E772068A254B343BEB86B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937626, "uuid": "8b6cc48e-195b-4b86-bd29-84ff19c1ef11", "value": "12288:dh98B7S0Xpps79sJgcFATyeUh1MV5qUZMtRBV6pZTbMb:Y/fWTye6MV5qUTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937626, "uuid": "02c923de-13aa-4493-b96d-add6e9ffcc3f", "value": 595624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937626, "uuid": "0008b58e-1bd7-4130-97b5-ebb14931e138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937626, "uuid": "89732a3e-3fac-456e-9534-aa06f75a29be", "value": "a2work_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e737bf5-112a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771900829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900829, "uuid": "ddd8c325-26c3-4f82-8d50-b79670d3798e", "comment": "Malware payload (Formbook)", "value": "92611544450f2d2a14ad0b37679fcb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900829, "uuid": "38a57fe7-4ac0-45b3-b699-d7738fcd351a", "comment": "Malware payload (Formbook)", "value": "6d8ea1c19a519bff2897050177477167f83760b7dd04906cc4e0dfb3186fe6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900829, "uuid": "ecbe4e7b-b9ca-4274-acfe-bce6762cbaf0", "comment": "Malware payload (Formbook)", "value": "be9af70503c2ab5bfa4990d0efc5d90b7c081fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900829, "uuid": "4dcf471c-229f-43fd-a76e-70fc3c22bf49", "comment": "Malware payload (Formbook)", "value": "2f68828024f7ed0d81def028675162c433084d1a86c013015a93f772e068aead49b57b30cb5eaf5dd83e1c9fc1f7d405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900829, "uuid": "e8135e94-a447-4e19-b8ac-bde1c906fc45", "value": "T19045BF027381C062FFAB92734B5AF6115BBD79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900829, "uuid": "4015f67b-5434-40e3-b39b-7e810049e348", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900829, "uuid": "36f12e2f-e76e-49d9-b4ec-207cb5b45748", "value": "24576:75EmXFtKaL4/oFe5T9yyXYfP1MAXDzL2FGqb/GzAT6Uu:7PVt/LZeJbInGizLwGqb/GET6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900829, "uuid": "d3c3e7ce-2286-4256-91f7-a8435b0f94cb", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900829, "uuid": "7295f009-b632-4faa-b815-7c99a671d1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900829, "uuid": "25dd083b-5430-4b9a-8786-66522ef2e24e", "value": "SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.28604.15472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60075ee8-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921528, "uuid": "e5cc22b0-7e17-471e-bce5-f8eb55b4ad0a", "comment": "Malware payload", "value": "f91cbc9057c8672652289a42be1056dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921528, "uuid": "7b86b351-bc51-4755-97c0-65d71b79e142", "comment": "Malware payload", "value": "6ddc5777715c531db0fa8473f4f217eaa81fcbcac5130ee3d28c5102295b179c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921528, "uuid": "b4ae678e-d00d-4204-8a94-0dc327ded3a8", "comment": "Malware payload", "value": "31513015f589095ea373873e0122766b74ab03e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921528, "uuid": "b452e417-18f8-409a-97ee-64b4a2a0751d", "comment": "Malware payload", "value": "a4bcb7b6c98caf5a90f6601bbf4c402828590d96c5ac5a53d7a0b037c04810e97908a41f381ea9a26b5ce3c909611020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921528, "uuid": "ab776ac8-2251-41d6-bc38-41426014a20b", "value": "T12A460955ADC22F66D6CC137486ED675623603E454BA2073323A4FBA83A7733C9F5688C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921528, "uuid": "9b7862a8-367f-4646-bb74-f8364fb6cabd", "value": "24576:DUbltto9YJamM7OLtx3dVo0bXuM7hn9g/9JOW3rWfDHubmxpkKkoVqI+R02GShze:UoeJaP7O7o0ZngdWfjuixpkVA+W2GSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921528, "uuid": "9ea2c6c8-cefe-4c5b-ae0a-f13455b2aee6", "value": 5832704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921528, "uuid": "4bc8c9f9-425e-40d1-b3c1-982e90876e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921528, "uuid": "e1e959cb-6d71-4c47-b56f-8074c147946f", "value": "mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34bdbaf-118a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771942337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942337, "uuid": "3535b5de-08b7-462b-9554-a6825a15720f", "comment": "Malware payload (RemcosRAT)", "value": "b790ab3b17493865b29c369221ea347e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942337, "uuid": "917fedac-cd91-4e9a-9a42-c74ebe0478ca", "comment": "Malware payload (RemcosRAT)", "value": "6f8e3ec4e11770eb4202b1ccae2423040c0703f7e7bbfd8330de0a7712f23498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942337, "uuid": "0297dded-a694-4f8d-82cb-d51e1455bde0", "comment": "Malware payload (RemcosRAT)", "value": "c34885bb51e07025a12f7a7c42cb9d7ff54c739f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942337, "uuid": "be6f7006-d655-49b6-bb38-b4281e944de7", "comment": "Malware payload (RemcosRAT)", "value": "59fd88f4de69dd7738ed94d04c7a3f7bcca3f0d7a0852527cc210c9e578e6a21137761e57df7b3fd54a878185a003856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942337, "uuid": "6ed2411c-afdf-4781-968d-79e743117b7c", "value": "T1DFA4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942337, "uuid": "46d8de80-a83d-4a22-94f9-fee2999f244d", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942337, "uuid": "14579a5d-6236-41b7-8244-d2c4cf0f3d9c", "value": "12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSyn9:uiLJbpI7I2WhQqZ7y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942337, "uuid": "429cf08b-c245-48e4-b467-326200bebe3a", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942337, "uuid": "75872ce6-eb37-4c53-99bf-3f06976c0a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942337, "uuid": "e0f5cf64-71a5-4012-9cb5-663aad609e6d", "value": "6f8e3ec4e11770eb4202b1ccae2423040c0703f7e7bbfd8330de0a7712f23498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca835df-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921441, "uuid": "1ecedc98-8254-4448-93b3-beac96e5e6ac", "comment": "Malware payload", "value": "5da93dd9411127cf05c033f3ddcec00c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921441, "uuid": "41baa8eb-3a5f-454c-bc73-2e9f40967d63", "comment": "Malware payload", "value": "70601674a699cb61e546b9931deb92e4733eedc50dac5d0adb88bc331749c3d8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921441, "uuid": "582bdeb6-f527-4cd4-8432-1c1fae8343d0", "comment": "Malware payload", "value": "c61e5ed1bb8e63e314fdafd61d5ae7a7b9608e04", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921441, "uuid": "70483f85-784b-4c8a-b268-36f242ecc48d", "comment": "Malware payload", "value": "90b771067160829a84d33a55f4c0520f327afdd39dbff0210e45c59f7e6c493f1da83014b233bf9fce1dc48f10fbf455", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921441, "uuid": "426c0f89-90dc-4a82-9b86-182406cf9351", "value": "T14B060186BB01043BC0BB453245FA6762626B8C4AC9D27787B604B51C6D7B78C8F5EF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921441, "uuid": "157d215e-781e-4f5f-aa77-7fc405f9fae7", "value": "98304:TiS7BQ+kIpmMp7118UFdQHipjdY1j6B0/orGVO:TiSVQ+zAubPvefO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921441, "uuid": "d97c6638-3163-4646-8075-75bedae7fb00", "value": 3888615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921441, "uuid": "6e83c318-7005-47a3-9495-51ceaff3d362", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921441, "uuid": "ace1e4dd-9336-4c3a-8536-2d929c6e828a", "value": "MehrAsan2.7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f1cdd5-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947383, "uuid": "894adf4c-94ca-4d6e-9ac4-d0a2bb49ce17", "comment": "Malware payload (AgentTesla)", "value": "19e1bea3b6187cbce216d2873fda4e35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947383, "uuid": "bad3d985-9051-420e-a1d7-f5a43fa9deb6", "comment": "Malware payload (AgentTesla)", "value": "711620c7cf77a009dba2bf22efad01d49127343f526680dbebf33785f9d1e8c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947383, "uuid": "d3682ad7-1b30-4194-8763-ee7d494ee4c5", "comment": "Malware payload (AgentTesla)", "value": "92c7e412c5a661e6dfbe6fb580f190e71fef4731", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947383, "uuid": "086965ac-5ddb-4b5f-930c-5661a294504d", "comment": "Malware payload (AgentTesla)", "value": "1a4d5fa7be3c43f292f3db57ecea6424cfa83877c128312576e38f00afe68d522520276d88933a9d785a33a461eb7511", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947383, "uuid": "f9c0d568-a528-4fdc-832c-3295c4978aa8", "value": "T14D153353CDCE03491034EDA5561338A9C0B0E83271F69AE28492B7F7D772A849DEDEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947383, "uuid": "7c01689b-0b16-4261-92bc-18e08346130b", "value": "24576:NC5mLQPzH14uRmeOT4PVVZHFx99qsCULqYQhPUTB:yEgT9RmedV39kfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947383, "uuid": "b63bc0b6-30fe-4ce3-8c71-67bbd6255db7", "value": 878073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947383, "uuid": "f30a737d-e016-4de0-83ce-907153106d45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947383, "uuid": "0c907316-b318-4119-958d-5877f53b512a", "value": "711620c7cf77a009dba2bf22efad01d49127343f526680dbebf33785f9d1e8c9.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02ea1cb-1120-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771896859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896859, "uuid": "05315f21-7b47-4455-91a4-b54728ff70c7", "comment": "Malware payload", "value": "5056a28d3b582277a979f584118f7f69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896859, "uuid": "7b443816-76ab-40cb-9ae6-e95e3b5c9558", "comment": "Malware payload", "value": "71d94479d58c32d5618ca1e2329d8fa62f930e0612eb108ba3298441c6ba0302", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896859, "uuid": "b11cc6f7-6c33-4213-b277-420aed0ebb0d", "comment": "Malware payload", "value": "057911429ac28d1e0bdac83799193d8336dce8bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896859, "uuid": "0efeb4ed-47ef-4924-8fd9-27ce3fd2876d", "comment": "Malware payload", "value": "3cfdc3d36d8615b41cab31e0b76917d8dfc7ca893660795b1e12a49c1c2d3c42d800d9f3a5b1ae8dfb905ef941d09dc6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896859, "uuid": "ff802eb0-2297-4a33-acdf-765ee547ae02", "value": "T163B27D950588383C3BC989787B9C1F894965B3CF9EA23E44746B3755C12E9ADA70C3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896859, "uuid": "bf084f5f-7892-4905-98d1-933bb7a868de", "value": "384:I3ow8U2BlUvlB/LKtn4Vmkvotn4Vmkv4LW20M3vgRbqOBABo0i+Zf:Iow8U2PxymVxymz5m+OBABB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896859, "uuid": "7bff60eb-3885-4718-b348-68bc50d22003", "value": 25103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896859, "uuid": "5c89a7ed-f403-41a1-8e1a-6a5051a616ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896859, "uuid": "e2610b39-7b3d-4011-96b2-fc6e93a15d15", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e452b601-1178-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771934634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934634, "uuid": "dbb7f036-bcee-4d58-8b5f-66b18f59d626", "comment": "Malware payload", "value": "fa367c871058be5f8a68d66b4416c4ab", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934634, "uuid": "74b48c85-753f-4667-81a5-4daad3af993e", "comment": "Malware payload", "value": "71f6c4375b930ecb7677cda7a7c3cb7e8fe1bec019cba1e46839c95985261d0b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934634, "uuid": "c4d8fc5f-959a-42cd-af42-d15ec9e242bf", "comment": "Malware payload", "value": "88116425b3e4f62f1c3aad58352bec5a0b579f35", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934634, "uuid": "708da940-9596-4854-aaa4-7901093146d0", "comment": "Malware payload", "value": "53b2e67872c78ebcb844bc720c69ff258c74224460e7eaf62fd32b9fd1470201bcaf57e4a226be6278c7a937905a6b6c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934634, "uuid": "7224455d-98d8-47da-bf89-e38e60553c89", "value": "T1A635602E9468753FE6EBEF3844922D7A3578D1A4710F7060D07AD9D8E085606E9F3E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934634, "uuid": "aa311095-7731-46a1-a2e4-f04b0966b6ca", "value": "384:xN3RPd9P/+E9ttdju5fDxoBaRDfiTtnJIIm4OMUXnXOHpvnYTrzo0PGq:CPGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771934634, "uuid": "84139093-aaf0-42fd-8a36-0537414a81e6", "value": 1145909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771934634, "uuid": "92b66679-ea9c-4cf2-a877-91179fed18f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934634, "uuid": "5cb170ac-3282-4209-ab30-71a8a49d82aa", "value": "Nr. 775 - 2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0a8749-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771917041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917041, "uuid": "b9ab1e83-453b-4ef5-b021-16fe974c386c", "comment": "Malware payload (DarkTortilla)", "value": "5f5904b648b63985e72d160686a9bd40", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917041, "uuid": "e2ca4b20-0b04-4c8c-bf3d-6e59ef6e0819", "comment": "Malware payload (DarkTortilla)", "value": "7217706a427ae2b3f057b66a1b30da6ff8d9792a243faa05b8d21b8d6bf3df61", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917041, "uuid": "e7c9f081-9514-473e-96f8-3f23c70de8e7", "comment": "Malware payload (DarkTortilla)", "value": "bf8d1968a36697400c49ca4e4a09ff8f2fe05435", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917041, "uuid": "78976af3-34cb-4ceb-83ff-2a51c8ea2ec9", "comment": "Malware payload (DarkTortilla)", "value": "1422ae96c8d451c8d0d594db5dfdf46f34e970c3f8cc387b1ad76427d3a5a03823628d687126cdc0360083b8dacfdba1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917041, "uuid": "c5278033-0ee1-4102-9ee1-c6278d4e5c6b", "value": "T1290533BF1A984A7076220F8ED7139AF85CB3972D37CC02057270AD936578B7A58B507B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917041, "uuid": "fcb44d70-cf2b-4ee0-aab8-3d06140e3ffe", "value": "24576:r9G5+Yg775gG6qOyxdKYFNeBLoqAKOuPX:xG5+YIrcoKYFscqAKO8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917041, "uuid": "074962fb-d988-413e-9995-38c5c0628382", "value": 824929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917041, "uuid": "e0b2de4e-aa92-4e8f-85a3-f37a0a9e5f29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917041, "uuid": "59c232f8-68ed-4934-9f6b-a372b6f9158d", "value": "ESTADO DE CUENTA 23_01_2026.XLSX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f30510-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1771921908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921908, "uuid": "dbcfef85-14e3-4a75-bbbb-f0cefca96ff7", "comment": "Malware payload (Amadey)", "value": "ad87a0fffbbe3cc638f7df3489d7bc9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921908, "uuid": "0b86aff1-208a-4182-a258-915b5941432f", "comment": "Malware payload (Amadey)", "value": "73268ba4f02818b8597b585147be43155afd621fa098eec72d1a3c4e7d341a31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921908, "uuid": "0806bfcd-eb30-4c70-a68e-fd0f1d3d9f4e", "comment": "Malware payload (Amadey)", "value": "70eb133b03b57692987aefd86b6ab56b4e3e1c89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921908, "uuid": "be9f62ad-2aa6-4f61-a60e-addefd1771dd", "comment": "Malware payload (Amadey)", "value": "e5e788da3e4b7a0372a8f22c8b5ece4eaae3455285f24d0a39058b46f2eaca5c72119250b030a65ed5be03e9dded76a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921908, "uuid": "61235d5d-691d-4970-9ebf-1131389f8eef", "value": "T1F3945B217916C032D66292711F79FFF185ADB8259F7109DB7BC00F7699202E26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921908, "uuid": "0b7f5afc-b6d7-4c92-b211-5070e3d2cf30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921908, "uuid": "f0dc6cb9-99de-41ed-a444-19c891b3fa60", "value": "6144:fboHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AOk:kHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921908, "uuid": "dc11f2aa-f2a3-4084-a9f8-1103ad693ae6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921908, "uuid": "b0c06d09-a7e1-47ad-b2f1-9bd963e5a38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921908, "uuid": "3402923c-7e3f-4989-9216-21d481da77ec", "value": "Payload (21)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be0a91-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928926, "uuid": "ea02a47e-0753-45da-a34a-c09855bb3dca", "comment": "Malware payload (Mirai)", "value": "c8abb23cf00ca73a9ff9146b7bd63214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928926, "uuid": "2fe962f5-5abb-4451-b096-cda4baf24555", "comment": "Malware payload (Mirai)", "value": "73273d3ee85cacb37df66e5f4e6b7ffc295d89f6d3299a1046b4d5f115efa5d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928926, "uuid": "07e2b3df-06fb-4f01-8f31-23b1a4d001a8", "comment": "Malware payload (Mirai)", "value": "57a779168fed7bbb147e79d87a1270b6aa348dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928926, "uuid": "2cc74cea-7a69-45d1-8616-3efc89c199b6", "comment": "Malware payload (Mirai)", "value": "3dbe6eda72d36331930c2b6e81b9274ab307db3ca81766a54bbfc40cc2c5bf998831e0f9821410f854aea910df6d23b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928926, "uuid": "38f5be46-a28f-4958-ab3a-8346bf01bdce", "value": "T1E8A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928926, "uuid": "4ccda7f1-9349-4fc3-bdc5-f6c16127df33", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7q+r:J0DOpPRWu8ERZ+0u8vjhhq+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928926, "uuid": "b4d18049-ac20-4906-9774-21f14d13880f", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928926, "uuid": "2a6ac321-63bd-4fbc-83fc-c45be71c8cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928926, "uuid": "e8e2806a-a0ad-4189-8118-b13f264087b7", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1cb670-1192-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771945627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945627, "uuid": "cd61507e-3225-4443-9b4f-5d52dcef9c5c", "comment": "Malware payload (SantaStealer)", "value": "deb109305674552a108a95940c4f5343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945627, "uuid": "9dea795d-b508-43b3-9245-a758be223185", "comment": "Malware payload (SantaStealer)", "value": "734016ba5dd6b4263d891973a88c3ee84b0fb3ed64ce6a3152bd7f91a79c877f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945627, "uuid": "d072d4d4-ece4-4e21-9a8b-efebbcae14f5", "comment": "Malware payload (SantaStealer)", "value": "c9370ae3d6646391efb51de1149c4ea33e69dca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945627, "uuid": "68026287-1c91-4eac-9764-f6376d5b6bfc", "comment": "Malware payload (SantaStealer)", "value": "57e19bc8f09cf0d3710f44406249971a4f4ac4fe48b6552da11876a4c0c0f2fcd1af48aa67682f1de367b3421e67c3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945627, "uuid": "0a8a1a8a-bb89-423a-a611-f948b5fb10d4", "value": "T1FF9623FE6154335CC01688385533B948F2F6851F52EAC89EB5DB7E907F6B821EA42F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945627, "uuid": "da2e448d-b8c2-4128-813c-7621cb953de1", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945627, "uuid": "998a38a7-ee95-4577-8594-41f68d224d46", "value": "196608:JylFh9sVUB8NQv7t9lmPScZV4QIKqlGBeR45OC6jIZR8IwFQnVAsfE3:8rsVUBqQvdLQIKElR45HTRJpVXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771945627, "uuid": "55ce1fb9-de19-461c-9d3b-42bc14a4d1fd", "value": 9342976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771945627, "uuid": "b4806a99-db56-4b34-81e6-194a0bff1771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945627, "uuid": "71645a77-7d41-429e-ae6d-dd0aa376c4bf", "value": "p4oPI3H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69a51c0-1170-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771931122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771931122, "uuid": "85609efc-499c-4749-b6c9-a254506b4a81", "comment": "Malware payload", "value": "909cf57640dfddb099eeb4dac325706b", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771931122, "uuid": "e04dc2b7-11bd-425a-bc58-2b29fbe8d426", "comment": "Malware payload", "value": "73ae9fe72b3340b95e7187cd51de3b7476cfb84aa20b9903cfaff4f1c96a3e01", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771931122, "uuid": "b21f45a6-2035-46e4-a13a-acc10d47472d", "comment": "Malware payload", "value": "858234642d3828443dbd82754195b13e7543a799", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771931122, "uuid": "78900adb-9a3e-4685-aac3-8d8571c20a1b", "comment": "Malware payload", "value": "01bcf4aaf4a1d8b7532b4d6e2e46e515cfbcb53fd78266ad0e8395a6e5cd4841977502f9b1acfb21848c73c52cbb88dc", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771931122, "uuid": "5b5a0e19-2035-4e7a-af4e-b4e8d798477a", "value": "T18F917CC1A669E748E77129EA053543091FEC7187D0B89E9282790F754F14D9863BEB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771931122, "uuid": "a8e350fa-74b3-48ad-9506-ddb4a7bc5be3", "value": "96:wLhpiSsyAEQm5Je7HnmwxGSSOuMLH61BO9ICA:yhtkm5Je7v3r61AI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771931122, "uuid": "a5a0a972-66b3-44d1-a2d0-f19bd30cfdb6", "value": 4468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771931122, "uuid": "d49eba27-36e7-469e-923c-b23cb43c111f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771931122, "uuid": "65f68701-f054-40e7-89d5-dec7531366de", "value": "Prepayment anti fraud and service.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54949110-11a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771953291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953291, "uuid": "e4bc9b8c-4ced-409a-97dc-bcc3c9a7c56f", "comment": "Malware payload", "value": "b6fa63544e8d759691ec7bdb9ff803a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953291, "uuid": "5f9b1f4a-69bd-4da3-abcc-b2c302bf82c9", "comment": "Malware payload", "value": "73da98e3602154feaa51f689ad8edc031c95a8f14e24e71e934d726f2008acde", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953291, "uuid": "afe241d8-deb3-4a90-96cc-81411e989968", "comment": "Malware payload", "value": "fa29033df267e50dd8faecc4d1cd75618de38599", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771953291, "uuid": "cdcb997f-670f-4577-a339-a4f8595bc313", "comment": "Malware payload", "value": "d43c37e6c064844510a47cb71695b77ad5cc0002d16fb7bfeb4e1ec2fb0a3838809b252b7b99dcca69bfe1b214b59b68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953291, "uuid": "ec6affec-aede-4cf2-9604-94e63776ad5c", "value": "T16B925CB412896C79FBD1CE79AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953291, "uuid": "2726e6a3-50ba-4734-bb7b-1e5c5f2dcc45", "value": "384:9vcuQpWx+BL0SWL0gszzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:9v8i+BL0SI0HzzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771953291, "uuid": "2ebb12e4-d217-4d7b-a9cb-2a7f07694100", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771953291, "uuid": "f13139d0-0d25-4837-ac16-d73cb4389790", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771953291, "uuid": "b6da3a4a-4b5f-4e43-83ff-0e03396e8227", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1431f701-118d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771943305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943305, "uuid": "ac3724b6-da9e-49a8-9580-d03168edc5af", "comment": "Malware payload (Formbook)", "value": "81ee4c1ab6ec54d58313f7714b1ecc6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943305, "uuid": "367df342-9214-43d0-b12b-0c23ef9cc438", "comment": "Malware payload (Formbook)", "value": "740117685e5ab345b8b786c7ee3127875dfea865c385ecb96296e9c2fad96dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943305, "uuid": "05dce513-df84-4e49-ab6c-57c68c4f326d", "comment": "Malware payload (Formbook)", "value": "3f32a2a50a9c4817a4c3686b247c34890c1d412e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943305, "uuid": "b15959fb-70bd-4a3f-9e5e-531c427762d6", "comment": "Malware payload (Formbook)", "value": "60d776a3a5c93556bc4c7132accc60250b73bf41f18224ca6c7022aa7b6aa7d5ab7ddd3a9f5c4c1162e90b83d51c69a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943305, "uuid": "bc04faa2-e98f-41f1-8eaf-fb1e881bdac9", "value": "T1743501686B61CB06D8E65B341771F6741BB95EEEB811E20B4FE8BDDBB522B148C04343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943305, "uuid": "41bec93e-be84-4722-a516-13ec55f04a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943305, "uuid": "1aedb830-929b-444e-9192-7fe32260f487", "value": "24576:pQlbCPu5x+bVqPFc61a+llb1kzxNAHH8Hsj:p0OPu5xeVqX1NHOzwosj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943305, "uuid": "85b49c2c-65fd-4e99-b5c8-489c85ace76c", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943305, "uuid": "5e1e4796-41b0-4f76-b56c-8f91099a3d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943305, "uuid": "7c3e1f4e-9c07-42b8-adf1-80a8f75d2cbb", "value": "PAYMENT 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1835757-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928939, "uuid": "87ec9b7c-ccaa-4029-9dc1-87a3988e9e8b", "comment": "Malware payload (Mirai)", "value": "43aa3825585a899b15516bd1c9292298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928939, "uuid": "8a961668-bb2e-4b8a-866d-b3e0b50cf00a", "comment": "Malware payload (Mirai)", "value": "74f40b7acc8ebd923bbe74955aeb4a4beb11eeacecb910279d681723b35f3be0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928939, "uuid": "4c4d0d9f-e526-4a7d-806e-f0f0ee87c820", "comment": "Malware payload (Mirai)", "value": "f1708c4559a158c1c8498088ac25111b7dfbc9b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928939, "uuid": "2b70af18-a944-4a86-b43a-0900951bb3a3", "comment": "Malware payload (Mirai)", "value": "468aac8127ea8a7c883200eb2de722e12e10ac24a86f801fc6c3fbf99587f01b467da4137727d9e98234f4b243da1785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928939, "uuid": "5dde3973-f21b-46cf-987b-fd991d0ceb54", "value": "T10E733B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928939, "uuid": "305c5ab8-ff13-49a6-bce2-4d57d8d057a9", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vNL:uB/VBBpCO72RDRZNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928939, "uuid": "290d9934-f02f-443d-b69f-3a9124cd36ad", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928939, "uuid": "ba721dde-8493-4934-8eea-9b1dae7c840f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928939, "uuid": "07d7ba5c-ab8c-4457-83eb-a68aae956872", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434f2a8c-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917614, "uuid": "fef304ff-f040-475c-b9ff-6c0ab4103314", "comment": "Malware payload", "value": "714534927476fa45dcf79aff8f9ae0c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917614, "uuid": "54650dcf-42a8-4714-872d-5df9f7646cbc", "comment": "Malware payload", "value": "7515f083a4a72b16d35d80db3b2bef51d9b1e84303410b6a5b4652df4ec4b30b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917614, "uuid": "8be7de33-1af8-490a-a0b0-574105430c04", "comment": "Malware payload", "value": "d1694cc56f356e782684ff06666911de98630c93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917614, "uuid": "9b30c24a-9ddf-4e11-99ba-71855fb5d4bd", "comment": "Malware payload", "value": "237cc5006456f55055c577b77b1d20948a2609f199f7e9a0861daca92603ef15ab7dc78ca3afe00444d6810a05bdf1d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917614, "uuid": "4b24dc60-d416-4d28-aea4-07d6a07a54a4", "value": "T1D6D3E81B123D32652F6411208633CC1586ABA7D8B5EF532E0BF549E587AFEB39810DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917614, "uuid": "41242033-18b0-4047-b14e-fbca8673e640", "value": "768:C8m/Z6sZjWsYuSwnckNuRkHFWpvhCQzxeLScFYHXwz04mYF6F2r:CPXZ6uSEY0FWp94YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917614, "uuid": "0fede372-c8bc-4949-8784-42dca69184ce", "value": 138930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917614, "uuid": "c0f2da9b-1158-4a38-857d-a089619f179a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917614, "uuid": "1392b7ae-1d40-46ab-99f7-9fb409929fce", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845be5ab-11b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771961532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961532, "uuid": "a305b48a-2407-4e22-9c7b-39db3220a9e5", "comment": "Malware payload (Mirai)", "value": "acc38c5c373632354efcafc3de3a0bb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961532, "uuid": "8570551c-f384-4203-ad81-b9b1f60cbbc1", "comment": "Malware payload (Mirai)", "value": "758bc5167f7893aa61c962eeaea79dcfc0041ab32cbee7748cca1e7089508eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961532, "uuid": "2c2f08c1-420f-49f4-80b6-62a09466b038", "comment": "Malware payload (Mirai)", "value": "7052c7751287663ddbd0d641b33ce33dc76cbeb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961532, "uuid": "e3a356f0-91be-45d0-9e99-5c575c479634", "comment": "Malware payload (Mirai)", "value": "fc4d31bd49e564688b95b8cee26631fe01ff96e0af312e91ad6ab8626690d8db0baff7b2370bc76c038197c505c0da32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961532, "uuid": "5b44fc11-5b92-4a95-a582-2b06b6043f05", "value": "T1CAA35CD0F243E4F5EC5301B1613BF7339B32E07A5229E953D37E9A32ACA1541DA0AA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961532, "uuid": "f30d3ab0-6d85-444a-95f2-8606f5f0cd80", "value": "3072:Nt/P2d/zQf8n3XEoW7og6mHvf/sQHXvdy2:Nt/udLQfeHEoW8gR/dy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961532, "uuid": "ef00256d-5770-42a6-a6b7-8fdab9bd4fc1", "value": 103244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961532, "uuid": "c25790b0-7977-4c29-9fcd-d4108bd0c672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961532, "uuid": "4feb291f-d449-4399-bd10-57252d28b566", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ef367b-11d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771974097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974097, "uuid": "35739d76-4ec1-4347-8bab-9ec3dff2d1e7", "comment": "Malware payload (Mirai)", "value": "5aaa79033865240ddbd9655c22f7558c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974097, "uuid": "afca2267-1b5f-47d9-8112-259eca5bae4e", "comment": "Malware payload (Mirai)", "value": "759eb8946bfc352904d14fb4c1da0bd0a7ed015e71e8239e18f33fb1363a2376", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974097, "uuid": "4ad15885-96bd-4545-a75f-f9762e6956c4", "comment": "Malware payload (Mirai)", "value": "8f2089ba19d47133f47519a0649178e633c337ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974097, "uuid": "7694d322-711f-4c73-bf78-702f16e951c7", "comment": "Malware payload (Mirai)", "value": "5e715f557034eedac68e1260f874cf368af214fed6fb314c20348542a1b1c35ed1d93f5fb1ab3bcb97d4347f033952ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974097, "uuid": "d11d0d97-3a42-4f35-9036-e0698af9a2d0", "value": "T1D5934B13B9C4C0FCC889C070479FB536D923F17E1275B25B6394FA167E8DE122A2DA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974097, "uuid": "cd951686-5cdb-4d0c-b54d-3f0c59970b87", "value": "1536:XmVmqfjvo9PTPIobPiHJhfQJjS1u1MsoWRo5uXlm+8Qv6:XmcsjvuTQ40hfQE1u1Msot5u1mIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771974097, "uuid": "1b388f67-e716-4295-bc89-982469ad2a75", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771974097, "uuid": "56413feb-c801-44c1-af24-6008992c27e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974097, "uuid": "5181fce3-4a66-4a8b-8b90-5153397061ad", "value": "ez_nigger.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1ffea6-118c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771943236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943236, "uuid": "11b406b7-42b3-49af-910b-2ad9f86f546a", "comment": "Malware payload (PhantomStealer)", "value": "9b23005b306b3bc093f9a35ef68f6bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943236, "uuid": "de203004-f063-4389-a8f1-8d6c92d4d5d2", "comment": "Malware payload (PhantomStealer)", "value": "75e1e4ec37074fe7a1aeb31ce3932192963f8423c6b9a02e41eb25f9f14f8ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943236, "uuid": "67b8d1cf-c14e-480a-a73e-ef0a001f3684", "comment": "Malware payload (PhantomStealer)", "value": "ae5f752ced126164a5074b7f7775206df854cb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943236, "uuid": "de6a0331-bbd0-4323-a7cb-6bc8dde4bf9a", "comment": "Malware payload (PhantomStealer)", "value": "90052a27961588b0867b941e88cf34db27043391f47c0348ef84e8885674bf695498d68cc8012d464ce01cd84d7df0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943236, "uuid": "80ff8bdc-ebe4-444d-8924-e3d0d17f2fb1", "value": "T18782753BFA18DFF80B2E51D1118B6C02605557A6A53A4DACB4DDC4587F2B710CFEA8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943236, "uuid": "cb8a7462-8689-4f62-ad69-410bc633828c", "value": "384:oRLUxn3UivFh6/sYU7Lnz+yQm6uicdWxi1wUC/qP:oUKULam62dbISP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943236, "uuid": "956ab03b-b968-49e2-b8ba-42db56ddde2e", "value": 18437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943236, "uuid": "ceb06b3f-3d1d-4580-afec-464b8937fdab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943236, "uuid": "3bcfc3bc-b94d-4d38-b1b1-99ff3dd4f0cc", "value": "Desc_Qtn_0550_24_02_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3101e00e-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919301, "uuid": "eea38356-d681-4fd7-ae06-f0ddc9d284ed", "comment": "Malware payload", "value": "2ea4d2dd7aafdfdb399bc2a03da570ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919301, "uuid": "01b40140-7509-4352-83ff-0cf637526d9a", "comment": "Malware payload", "value": "7733396ef1f323f4de54a740ea7e3b5d257eafaf71b294359f3b9e095aba876a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919301, "uuid": "d13ef7bc-97b1-46d0-b640-f39434f49dd6", "comment": "Malware payload", "value": "83713545866e4f46adb95867b030d662547b22f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919301, "uuid": "7ead3965-12e6-44c0-96b0-1e3d2a22522d", "comment": "Malware payload", "value": "5a7b08688c62d5431f19d073f579df2832213903ee2f15b0d81e370196e2732aeae5a17c599912ddb82afec29d5a1302", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919301, "uuid": "fad025a8-aa9c-4325-8240-188a6b926716", "value": "T1C4D3D87B4AE1C0BD24C68308BE7EC449B2C52B071ABA0E4EEDDEB54D14EDF557AA4D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919301, "uuid": "28d09af5-94d3-4538-a2bb-904161614b3c", "value": "3072:CPXZ7YwAv7GBmH6cpjAAC2MNmHITySps1cwqzZs+XYLKj0ejfxbTlolc15JfKwj3:EO1phX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919301, "uuid": "919e595b-9d50-4131-84aa-353e8e1478fc", "value": 135210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919301, "uuid": "478764f0-ec8f-47da-8f47-7e2f87f5d7be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919301, "uuid": "a1e05ca9-f054-4cee-9309-5148a0570200", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188bf2bb-116c-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1771929139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929139, "uuid": "93c2c441-2a88-411e-a675-5fdc4aca07f9", "comment": "Malware payload (ChromElevator)", "value": "12b5061b751f47b293a382e179ae3941", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929139, "uuid": "c7b30404-e852-4cd2-83fd-5585b06281fd", "comment": "Malware payload (ChromElevator)", "value": "77cb78e3dd35dc1d3e2730449a44e0f66276737c99182c6108de538820f9b39e", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929139, "uuid": "3bae285d-d807-4156-81cb-2f5744cd9820", "comment": "Malware payload (ChromElevator)", "value": "cb9fa68a3b80a58402304075cb18253b38956e0f", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929139, "uuid": "597a84bf-9aea-4f8d-a15e-973c0c6f29c2", "comment": "Malware payload (ChromElevator)", "value": "adc314e65efe65695272b1d0b06ad2a1bae099390ab8d52fc6986da4d4f228258f978e226afb07348c62cc4d4294d99d", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929139, "uuid": "4f9b062f-1e6c-4fbb-8939-b3f67471792b", "value": "T16CD5E14AE7A801FCD0A7C6B8CF429513E7B2B8061730A69F57D58E862F277719A3D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929139, "uuid": "a0ebe5c4-dd91-4509-8b84-a71b1e0105e6", "value": "91840664d39435bacfacc7a036c0bb1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929139, "uuid": "f9a902af-054e-43b4-91c0-5e6dce816005", "value": "49152:FcSomqw6UDUiyVDEITKNagEfBLLjIrDGkbqUfiKh0O8T+tysrA:FX4XVRfBLYrCRUfiw0OkMyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929139, "uuid": "127c4f1b-8124-492a-bfee-6b2f71f9a9ae", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929139, "uuid": "24c615b2-c733-4ac6-820a-4ea647781098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929139, "uuid": "44ee773a-d71a-4cd4-a0e4-8b82124a3bf9", "value": "12b5061b751f47b293a382e179ae3941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0410a6cc-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917508, "uuid": "d15cc439-efd8-406f-806e-3f1a92c9650c", "comment": "Malware payload", "value": "256d1dd7ea64f7ec7d4c277aa4bf0525", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917508, "uuid": "690d75ef-a154-4499-a46d-6a7fb07b4a3d", "comment": "Malware payload", "value": "7823e0a6d1a95aad335151edcbea9f5b96ed0ac93c114e48b27809db26a9c22e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917508, "uuid": "bfde58f2-a9ff-4cef-8900-5eb8903567a2", "comment": "Malware payload", "value": "e4c967be846e011d8ef417e24777dbf1a8aa149d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917508, "uuid": "b8f1709a-a385-426b-a056-b539ad180f73", "comment": "Malware payload", "value": "347112858b2832d941ab82de9edc2895ee0f22734f6915b7bcebf52912611c9b92badff37319f1e202d4d2842c211305", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917508, "uuid": "cf998575-f4a0-482f-b7ff-ce739d37619e", "value": "T1D2D30A70BC93EF95C3532ECC35484B2B90A74E3855B3F690F6053451AF65A0BCB66AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917508, "uuid": "a49e0a5e-1000-4881-a769-1a96e38135bd", "value": "768:C8m/Z6sZjWsYuSwnckNuRa+mTzFZpPxoxeLScFYHXwz04mYF6F2r:CPXZ6uSEY+FZp+4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917508, "uuid": "902db7ee-2204-40ff-8724-2ca14aa258fe", "value": 139864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917508, "uuid": "58c67f47-0aa6-46b8-a36a-39bda825debd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917508, "uuid": "8bd3cc96-f6b5-4fbf-b504-e87c7ada8e25", "value": "invoice-1645080830.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4b0b83-11c3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771966810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966810, "uuid": "c1d2cf24-f10f-46fe-93db-7f9826e2924c", "comment": "Malware payload (ConnectWise)", "value": "cf2f2cf0927ccc0497e5860422299b72", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966810, "uuid": "fe5b44bc-0f7e-44d5-915a-ac3cd6e28037", "comment": "Malware payload (ConnectWise)", "value": "784bcc73bf933e33d084812f7aea020a47030943f67bb5cc11e1fb0585e40e6d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966810, "uuid": "d815f281-4d15-444d-a04e-ff7847f62f21", "comment": "Malware payload (ConnectWise)", "value": "4dbb1800c9a3c5e2b5c50ae9a47a57d94197d49f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966810, "uuid": "14da8054-c7d6-4e72-baad-7e6d935cf8a1", "comment": "Malware payload (ConnectWise)", "value": "2927aa84c65ef15ad319dd075267f3e56d92e1c0eec5c9a4ecc799521609a18880dd92c9631a8631070d6730b5fdfede", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966810, "uuid": "6db2b870-5fa8-455e-bf80-f2423a9da11b", "value": "T16FC61211B3E585B5E0BF0A38D87A86562A34BC049716C6BF57A4BD292D32FC09E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966810, "uuid": "8f127013-65dd-4079-9487-a6b2b2701cde", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966810, "uuid": "8128015a-aec2-403b-af2a-115c87680965", "value": "196608:C1EfefPklKaLNkbgHi4QJKaLNkbgRKaLNkbgXKaLNkbgo:C+WgHiHtWg1WgvWgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771966810, "uuid": "7f97d37a-eacd-4b51-9687-f8a0ff8f03f5", "value": 12580920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771966810, "uuid": "7b968989-5d3b-4552-9ead-69bd43ed068f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966810, "uuid": "ad2cce90-eeed-4c53-a593-cb204a493711", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f07a3a-1189-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771941588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941588, "uuid": "9e459b70-0772-45b5-8dcb-ca6a0243bef4", "comment": "Malware payload (DarkTortilla)", "value": "b38e96c6d9377e602f4bf69952e6f43e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941588, "uuid": "1b394f42-4596-4169-b11a-ed5b3aa9d2c6", "comment": "Malware payload (DarkTortilla)", "value": "787603ed370b21f4b0c042915f7fec0e3ad9f1a74f9bea21a99f9e7a5232a31c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941588, "uuid": "046c88cc-6630-4d60-ab29-a146008ac24a", "comment": "Malware payload (DarkTortilla)", "value": "769648752d85f3ffe45e59d6272948476a55f6e7", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941588, "uuid": "1768d63b-d03f-4b28-9839-7af78fbbd887", "comment": "Malware payload (DarkTortilla)", "value": "570d76370e97027196f8b918c5180b967df2a3fe1eb3de3eea0bd5c4cf5a91241dc3186694e201db59c8445c99dcc2be", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941588, "uuid": "930a436c-06b4-4a04-80cc-d98d41a98d5d", "value": "T12CD4D0324E932729D66E5B79C02208A837F0F61B8222E71F6FEC41F55AB7FC5C916914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941588, "uuid": "f7624903-0617-4a03-8e3e-5dc8c80e9a1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941588, "uuid": "86ddbe32-2744-4817-a8f9-d680cd92eb71", "value": "6144:rVrwBZuOQutSJGFaaz+dmhwqwvZM61XdPL1B1+J5MEsoUfY/sMhwRA8DsyzuZKqI:aBgzJDiXAdpr+8Esd4sEwRA8DzzuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941588, "uuid": "8069ed6b-6b8e-4535-8a9e-36a9d70ebf72", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941588, "uuid": "85c8a202-2290-4e92-bdf8-b3dabb27bb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941588, "uuid": "10c4cc0c-8e47-49ad-921e-0f0173254105", "value": "SOLICITUD DE COTIZACI\u00d3N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6484d866-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921535, "uuid": "5efd016b-c647-49c8-bd06-49d1ff7b509a", "comment": "Malware payload", "value": "01bd658beffb099891e33d3ee8e9786e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921535, "uuid": "852aa3ad-3e4c-4a8a-85ee-7a3f167c6d67", "comment": "Malware payload", "value": "7890948b9f85065e3c81c538898d268fc1f262e244cab0d7f2184829d86bcd9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921535, "uuid": "cf09539f-733c-4440-a1e8-250b21e56119", "comment": "Malware payload", "value": "6d83c710c4bcf1d1b25fc21457221605d4486095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921535, "uuid": "87988ea5-ea44-4666-9fe6-62d7ae821f8d", "comment": "Malware payload", "value": "da9f25dc6ffeb8e0917081494a474e8a0518e40dd75b57d204058e2496c6ea0e8ce398e2f06a444142ccd653a31cd258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921535, "uuid": "cd99ee66-147e-46e4-b212-fd3cb8b9b2e5", "value": "T1BE46F705AD842BE7C42C4F7495E6CD6522B01E140AF14B3A26A5FFE9BCB62747F0399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921535, "uuid": "93170056-c731-47ec-8e56-0739175b94e9", "value": "49152:YzYDt2QsZfbpswDWvw96InSJQ3JljeVOl:Qsw6ynoAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921535, "uuid": "f11e0b9e-356e-442c-b8ac-213dd51f214c", "value": 5767168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921535, "uuid": "3c276f3f-2cce-495b-8e44-35d05e9bf5b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921535, "uuid": "4627a7f4-a17e-422b-ae2c-94012723cd28", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3717dd-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917632, "uuid": "2b37bb96-3b4d-47c4-824d-79457d310f59", "comment": "Malware payload", "value": "03ee41c8eff2d72b6e816d1bce2887fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917632, "uuid": "993b43d0-3a8b-4a65-8200-672480be422a", "comment": "Malware payload", "value": "78d398dd061a319da1abc8682bf861d7c7ce7c31eb2487c6f53b3be38879c841", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917632, "uuid": "62396e7f-10e0-447c-be0c-691cb1baeca1", "comment": "Malware payload", "value": "a302bbbcca735f9c63e88f3cd609c56a959f6846", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917632, "uuid": "e5b7253e-e491-40a3-a636-de103d722d17", "comment": "Malware payload", "value": "2adbc06e6133fa9bccf4a790400ad6bdc6b211b20bdab8ada8e875bbda1d1eab80db6f05d3383b71c712d779c623059f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917632, "uuid": "0d70ad3a-7f4f-4851-a895-253673ac200d", "value": "T1E3D309C0AB14ED0BA3D13929F81EAC79099AC3A29723BD11E4DC6BD2AC1757125D6F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917632, "uuid": "b95e256f-0e45-48e3-9ca1-d161d6e77dbd", "value": "3072:CPXZ7YiKTKbKAKOKmKGKEK5KUKZKmK7KNKKKXK1KfKFKFKKKFKVKrKBKyKYKZKXk:E6m+/5hBzwDQhek168SMM1McOINHQ6fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917632, "uuid": "e2e53b65-a69f-4b6b-af03-1bc1c71b5b2f", "value": 139889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917632, "uuid": "9aebb98a-04eb-4d4b-b9df-443a32f9c9f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917632, "uuid": "7b8ea1cf-ffa3-4fae-b1b9-aba817eddd00", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f04539-118a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771942229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942229, "uuid": "52683b13-fb48-4a1b-84d6-bfc6e3113add", "comment": "Malware payload (RemcosRAT)", "value": "dfefa8e80d55af581dde3a31cf1afcbd", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942229, "uuid": "a8a6dc28-daa6-42da-9cb5-e03747450c6e", "comment": "Malware payload (RemcosRAT)", "value": "79d7358fd1cdaecc1adf0c054c2394abef95df87ef5191f70778da24310c790e", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942229, "uuid": "28b91bd7-030a-4008-9e7e-f99c2c2fdc7d", "comment": "Malware payload (RemcosRAT)", "value": "0ec6ad14a5fe77362d9fcdab78ec6bbaaf137909", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942229, "uuid": "7cd0fc9e-c618-48cb-a342-26e4e2a6c4fd", "comment": "Malware payload (RemcosRAT)", "value": "d29db92d0b630f524578d88b05bb170a87581733e2626c27bfb66eca0002c1fbc21ddb337c5e97ff7020835d84d6d20d", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942229, "uuid": "85f3c79e-5009-449f-9347-a0d571debf99", "value": "T1C841EAA37FC40DE28E7C521D4337E7AD227A2CC023762DE936D97E6C9B6411698A1404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942229, "uuid": "b09f299c-3466-4bde-9c87-47036b0b365f", "value": "48:FL1P36aS5aeI4Jam7duTd008Erl6Llfp9rxvNN2Efd31K6vJ3fwYKunarhw8:jPq/5aezXoHLlIlzr12OlK6vdfwVunaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942229, "uuid": "a04ed462-d3b5-4cc8-9e4a-6721e838abcb", "value": 2311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942229, "uuid": "dc58b0b3-e361-4636-9828-8311685b89da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942229, "uuid": "b4b5011e-52a5-4e61-8cc2-a7e8fca3906c", "value": "ps11.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f43bce1-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919271, "uuid": "cdda4deb-7a9a-4325-a641-0c18e972928c", "comment": "Malware payload", "value": "ed96b3969c632224bd0e01b4828fb407", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919271, "uuid": "f32061ce-7670-4ac8-88e9-5d98c84195de", "comment": "Malware payload", "value": "7a50197f259c88a2813b1b6826e84dc4bcaeb56ffe1e2ab3b58b5216837b712f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919271, "uuid": "33675250-f16b-4933-9dcd-7c2a76348359", "comment": "Malware payload", "value": "c8cc4ccbf0df6457332fd3142f8eaac64385ea54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919271, "uuid": "999cc2bd-67d0-46ae-8219-7f26e6f58f05", "comment": "Malware payload", "value": "83917ed9f6cc47bc066cbc61a740bb817bb5398c79adc73d572cd9caeced184af5a903ac905c2d50823696a563c0c918", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919271, "uuid": "8259bb8b-2a94-472d-a3e8-3a587c041803", "value": "T13FD318C64FC64DBD155A7286148C8B2A3E2ADC03CB999B2F5F01AC0E3C2D7758EE7951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919271, "uuid": "91086998-2dfa-4f46-b01a-9a590b4bc1ae", "value": "768:C8m/Z6sZjWsYuSwnckNuR3p7Fe3u5CffmxeLScFYHXwz04mYF6F2r:CPXZ6uSEY3p7F3l4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919271, "uuid": "be5eb756-ffb8-45dc-8f5b-2a733f54bec0", "value": 141844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919271, "uuid": "ef2ff933-33b6-4600-b75a-9a970de4ec3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919271, "uuid": "93eccbfc-dd22-414b-975b-1901a23a8441", "value": "invoice-1645080830.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb762127-117f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937680, "uuid": "c03345ca-1094-447d-872a-cf5f622de623", "comment": "Malware payload", "value": "fd1088d67df92bced79c48d04799e124", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937680, "uuid": "34680773-04f9-4219-a93c-086722182676", "comment": "Malware payload", "value": "7a7cda2528d2349879cb3343b33bf6ba405d8307fbf40c0e63e5ef01e3c38cc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937680, "uuid": "45d0d316-1306-4cc1-a8a2-16807362a17e", "comment": "Malware payload", "value": "24f2dbef03e877610feb0d6a233517613b631979", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937680, "uuid": "6e764728-f0b3-491a-8800-bb24d640c041", "comment": "Malware payload", "value": "4c1af6cedd7de31fcf61d407175074ec2ea7e0a946cca82d9378cdd68b10d4d20cd772d2fa6fe8c2180a3b742f3de2df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937680, "uuid": "4b740f2a-7a2a-45f2-9fe0-8c25276f59b0", "value": "T11E219379034004399E67426143E7F8C8F6CB1C574CE8D41CF21EAB125BEC0890329E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937680, "uuid": "e257a040-30cc-40d8-aa7b-0b4e3d8227c6", "value": "24:7WCXPQji1rO79LbSE4ZtWnQiZa0RTYWusiyIKylMPYkM6:quPgIa9LbStTZgJTYTsim6S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937680, "uuid": "d0434148-52c8-46a8-a151-525b265fc291", "value": 1147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937680, "uuid": "2a10f206-bd9d-43a2-8916-b0a85b82ed4f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937680, "uuid": "462f61d2-52ae-4451-b5cc-6a15f245c519", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f73f00-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917623, "uuid": "7acf8779-3b3a-44a4-ae42-22ae0b7a9c64", "comment": "Malware payload", "value": "755ee086c676383de06af9ed82003d12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917623, "uuid": "5fd9ab2d-c4f8-4403-8b0c-6449be2a428e", "comment": "Malware payload", "value": "7afc0669d320aa1407403349becb72dc0bcd94b3c7bdad29c6a8bd48604fb1f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917623, "uuid": "b6c868f0-505f-44ed-9147-8edff73f66d2", "comment": "Malware payload", "value": "115ea600887389eb95048606e50a6fbecadacc84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917623, "uuid": "506ae13e-3517-4651-b04f-c23f36e33dd4", "comment": "Malware payload", "value": "8f04265a54fa44089ca5c27fcb39941da980c674ef329aeaf2aa87a2575c63c450fde5e861fb197f334062fb1db827b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917623, "uuid": "015f7d0c-a9db-4d7e-87ab-1575105fc022", "value": "T1A5D3A59A48A01754EFE934C2B72F9C0199EDB92431ECDF967AFB19581C08F2CBD9D064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917623, "uuid": "f35af1cd-138e-4e94-9527-3dd8039059e5", "value": "768:C8m/Z6sZjWsYuSwnckNuRIn7nFGxl7UGp8+xeLScFYHXwz04mYF6F2r:CPXZ6uSEYIn7nFmpx4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917623, "uuid": "1786efdd-f4e3-4b61-a94a-3e0fc2cbd4f1", "value": 137998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917623, "uuid": "00953b6c-90b9-4887-8fb9-4415b26ef6ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917623, "uuid": "687f2df5-7353-4e90-bcc2-d40659bfb80a", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0339acbd-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903763, "uuid": "d2429b01-54e6-4a80-afa0-76f8407f4fd3", "comment": "Malware payload (SalatStealer)", "value": "58b86597e7bf0a8e001848ff9e4d6148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903763, "uuid": "3d72aefd-f8ab-4f92-9630-3e9bb0db8508", "comment": "Malware payload (SalatStealer)", "value": "7b9e8f8db44e8681765aed67147fd9660de641e9ee7b99b49c3f6a2024fe5795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903763, "uuid": "090bc93a-722b-4c87-b7be-da1d5c5089f8", "comment": "Malware payload (SalatStealer)", "value": "7ef8627be8cc031b0c23041496c36375aab2e0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903763, "uuid": "00e07e9c-10a8-4a2e-aa8f-1b9329c5e8c3", "comment": "Malware payload (SalatStealer)", "value": "2ee4bd559506ef3f0350c63b61a39b9c09c93748f60e1c3770c5ed5efec2e5012ae7c19cf991df7fcb7d5f8abcd47704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903763, "uuid": "85994864-eb2e-4ef0-9996-d019f12970c3", "value": "T121473375E09FADA3E2AFEEBF6C6DBB641441130F8E01C8215B5BC885CB617CDA942507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903763, "uuid": "a45c5653-cf7b-48c9-b50a-e2cbbf934b8a", "value": "fc648d00fda0b8c1f218b9e9e89292fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903763, "uuid": "74e966e7-5469-4a27-94f0-e21d09204c05", "value": "786432:MnpzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzWzU:MnxMMMMMMMMMMMMMMMMMMMMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903763, "uuid": "4ef824f0-bbac-40bc-983b-bbaa40a5c31a", "value": 25794288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903763, "uuid": "2133b18d-d8ba-4f07-9544-530e118c8b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903763, "uuid": "521be38f-0ddc-4eb4-9a79-de9754f95983", "value": "Anticheat (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456efddb-11b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771961856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961856, "uuid": "66811860-ba18-41c4-a2e5-9ec689848ac0", "comment": "Malware payload (Mirai)", "value": "9916405201c52ae4b9be5c7f159fde93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961856, "uuid": "c77a8222-60f1-433e-b354-fb7abe5f5885", "comment": "Malware payload (Mirai)", "value": "7ca966eb2a3ca677eee6c86f299ebf7649672f00a8b754cab6cca0b97da8c9d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961856, "uuid": "d8c13421-fe08-4dc0-ae3b-9a93fbfb2768", "comment": "Malware payload (Mirai)", "value": "06ca5acc05c57ad7ba97eaad70d8f9e1f7735de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961856, "uuid": "e9a67e7e-f4a7-4769-ae71-9f86b8a7c1c6", "comment": "Malware payload (Mirai)", "value": "d19825c208bf3ec5c721121c244437e02aa76d24e8879ad935da7880c06e11e8700941436bfb759a4bd2a58f9118d552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961856, "uuid": "3bd88fdf-949f-4008-bf39-44fe8fd67de0", "value": "T164E31945F8404B23C6D612BBFB5E428D372A17E8E3EF720399216F25378696B0D37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961856, "uuid": "3a0aabaa-866b-479a-b2f5-03183471cddd", "value": "1536:QXoiOfPLNJgpNQXtVAbhyovMObqF8ZAx7G4VRIa4T+/j4JzhVAOWqWAEPtC6v+zj:QXoFmKokCu8ZH4Ap6j4JNFE1Zbq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961856, "uuid": "b24da981-6604-48cf-97ba-86b99c9b04a5", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961856, "uuid": "b10113a2-a794-4a37-bf23-0a1a9febf739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961856, "uuid": "ca2c82cc-18fe-488a-9989-5b5ad6dc810a", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61be86da-1165-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771926255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926255, "uuid": "8bb226c7-13fb-4c49-ad6d-5f225cd98c79", "comment": "Malware payload (CoinMiner)", "value": "89926cc659da338e230a2b603c57ccaf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926255, "uuid": "2806f46d-1d81-44e9-b0cc-a22458e152e7", "comment": "Malware payload (CoinMiner)", "value": "7e13ea1a09276d78b1dc2fb30b43ffab6562e030246016d2c93e59281da869cd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926255, "uuid": "98c97b01-de84-4502-a84b-9db9e2b89067", "comment": "Malware payload (CoinMiner)", "value": "8fc6026e5004a8b7a9aa57c063163373a0136da2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926255, "uuid": "34235290-6264-42f1-b988-ffc4b56250ca", "comment": "Malware payload (CoinMiner)", "value": "46bc19b1de801c1704349e26b773f450a3f7f52256315ce1a75e6227762a32929f793de4d70328d81b3f690076aba510", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926255, "uuid": "4945f0b8-afd3-480a-a04d-c546ad8f1862", "value": "T1480733D7F6139EE6D39590F418E1D7942371A02BC6030FB36B58A38AADFA2A50FD15C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926255, "uuid": "f1411c1f-03e1-4a16-aa5a-cd004d232f4b", "value": "393216:+Fwy3is9by4t/iPqXPHCkHFDlcugmERcS0nc77YeiD526BPDmmERcS0n1:sw6by4GkHJlVY0Ph5D201", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926255, "uuid": "d00b4179-eab4-427b-a558-9b3fa7d845d7", "value": 18442996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926255, "uuid": "b31ad34f-3c6d-4b28-9f7a-2ae991658c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926255, "uuid": "b3ae1fc1-39f8-4215-af49-b055ca395926", "value": "syd-api-01_1771885459_elf_BcVsmONR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e89d07-114a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771914496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914496, "uuid": "c45dc1f1-d036-4ebd-89f6-62fccd495bf0", "comment": "Malware payload (ConnectWise)", "value": "614f0a277fa12a3817e45184728ef57d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914496, "uuid": "c82f1347-2d41-4056-8ac7-d6c4110b9830", "comment": "Malware payload (ConnectWise)", "value": "7edc9a5dc57b7d6a4f12154c7f58efe56a279e791835f745a1ffd2605ab439b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914496, "uuid": "b54485cd-80ae-46ef-90bb-d466e04c124f", "comment": "Malware payload (ConnectWise)", "value": "a2e7971742f92d5150527b4ada7e95630dc2777b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914496, "uuid": "b0a4755f-40c8-4ef7-aabb-b9ef0af93fd6", "comment": "Malware payload (ConnectWise)", "value": "159e685810e9950e870bcdd7dd96ffc080d33f2f14cf8affc82f19d2f3bba985132695a038fe38a050ad2b393f4c4cba", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914496, "uuid": "b4a4563b-eec5-4095-85e8-e252267956dc", "value": "T192647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914496, "uuid": "d57d2375-4f80-4730-a497-b8cce53ce1e2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914496, "uuid": "ce314e43-ae9f-4119-b7d2-e9f4270de175", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9a:o1iw7gryNkSV1hy1Z1u2JLu9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771914496, "uuid": "051b10a4-6dda-41e5-aaa7-b6c7f35b1f92", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771914496, "uuid": "563c39b2-a206-49cf-847f-0b5d3f662d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914496, "uuid": "6a24e749-d574-410a-8c97-fb4eb6e2341f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b35beef-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917520, "uuid": "b9f71005-8445-45d3-ae8a-9498b14efed1", "comment": "Malware payload", "value": "44ad69caf44b87868ef680f95f3ee9c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917520, "uuid": "4293fadb-deda-4d15-b77b-0d6dce70d572", "comment": "Malware payload", "value": "7f015c8b094d90a2440f918a0667e4def84805860931b73f6478877b650c2c23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917520, "uuid": "42655a97-e104-41ff-ba97-21992dd85e46", "comment": "Malware payload", "value": "3de09f9d9556eda40dcb19c2b20b99afcef6b5fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917520, "uuid": "234fe3c3-0620-40ae-a1b1-3244b0425f44", "comment": "Malware payload", "value": "a55885305426bc132207b2fcead92fb16c8412cbe94773ff4eef0364adcbff6d32cb72e0907217a6582d92de4a207b65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917520, "uuid": "178900fd-cee9-4ba1-8b44-3c72af712dd2", "value": "T17DD3D93F473F2D882EA43A2D033D21446CC62E695675B5FBF51B88E539191EB6E0423B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917520, "uuid": "6fb0c9d3-81e4-4820-8a3d-4e2068fb2acb", "value": "3072:CPXZ7Y23EHLHuUmcO9R+MTbVP8Wr/Rq7JehrWrMWqgUYptyScQTwexl7TbTx0bal:EV3EHLHuUmcO9R+MTbVP8Wr/Rq7JehrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917520, "uuid": "a6eb7f31-934d-45fa-bd27-97179a9d8991", "value": 137019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917520, "uuid": "1f4a56d3-a090-4912-832d-7e41c25c8218", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917520, "uuid": "abbce5bc-9558-4f81-bd91-16570a409ee0", "value": "invoice-1645080830.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24a6f17-11cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771970736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771970736, "uuid": "d58c51d1-05b0-42c1-9837-03f9d78b3d6e", "comment": "Malware payload", "value": "57bcf267b18aa3e00f5046394c85c055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771970736, "uuid": "ece339e6-abe4-4389-94e5-4e1819238af5", "comment": "Malware payload", "value": "7f7e42c6fd41ec1e4c069e94c221552a88992975c4e4f4c6f1648683adbad974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771970736, "uuid": "70172088-48af-41c9-8179-31e1960a397e", "comment": "Malware payload", "value": "d922ced396fef9ab90dbcbb8adc7cee2bc4b4522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771970736, "uuid": "5e21308b-a6fb-4afc-8c3a-1dc1f1fe7306", "comment": "Malware payload", "value": "73e29208e42d82108eaf2ddcf73422b7aaa7fc648f5cc0bb63b41b50ca91a39a947baf6518e99603b1d36401268ec9f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771970736, "uuid": "a1f0b680-9f09-496e-9251-6661a06b5b01", "value": "T12EE6335843D200E6E9D7A23D06AA9AB2D7727C000B51C58B5BD88B7B3F533E55D36FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771970736, "uuid": "7bfce939-b86d-4a63-b278-e7938ae1a8c9", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771970736, "uuid": "801d8dd6-814a-4dfc-afbc-44712631bfcf", "value": "393216:1gtb5eorxD51cdq1B7LOXP8Rg8sUcHsoq8bpib:10HrxD51cg1wLdUenPbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771970736, "uuid": "d3f9c20b-adc5-4e08-9a30-b1b57d99a8d1", "value": 14860232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771970736, "uuid": "2ec8ef35-3461-40c4-a15c-b2f13e94ba9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771970736, "uuid": "4e9b1e69-af41-4968-9fe1-282eb9154cc2", "value": "PremiumV3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa157852-115d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771922940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922940, "uuid": "513c79c9-24e2-48d8-bd46-1481f3fe7bfd", "comment": "Malware payload (Mirai)", "value": "be71d64de8f1df3b47ca98e7efe7f1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922940, "uuid": "0792209e-9c13-4748-93e4-c917174f531e", "comment": "Malware payload (Mirai)", "value": "7fa9b757c1826b025acd45e359260397bb863dd82d6be5c557812538cd40bb23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922940, "uuid": "2c31e2e0-eaba-4bc7-b184-c6b045f21cca", "comment": "Malware payload (Mirai)", "value": "02d0e0ecf8483f39702af610bd963175bc523518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922940, "uuid": "34fdadfd-e9bd-4dbc-a837-a71602eb804b", "comment": "Malware payload (Mirai)", "value": "ab82d497267d0539328ffc38c8af9a0a2fac35ba7ecdd30e2e86fc931111738a5cc1b743feaa645c69aa539c24f24229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922940, "uuid": "15329b7d-0dac-4d65-bb40-25d0136821cb", "value": "T138839D77E9265E50D09689B0B4F4CF351F63A1C082531EBA26E5C675A087E8CF502FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922940, "uuid": "4e5ebdc8-9b25-441f-946c-130e5d49aca0", "value": "1536:eaQiNhtHOfYmH1+NYTszsYKG5NX7Z9Z1kCi+zRtJEp:e0/HOf3wNYwzsfGv3Z1koVrEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771922940, "uuid": "ccd9347a-38e7-4b70-87b3-45ccd251ffd5", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771922940, "uuid": "b563c733-c4bf-47ef-bff0-d3a90269a882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922940, "uuid": "f4b7daff-3ec9-4312-9a2e-65c2b56b3cde", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdae64c5-111f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896344, "uuid": "919b1992-3a49-4056-8352-f79abecbf9fc", "comment": "Malware payload (Mirai)", "value": "faf7f07cdda532e6f18d77a4561201d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896344, "uuid": "9182bb98-13f4-4686-b60e-9d8121c791b3", "comment": "Malware payload (Mirai)", "value": "7fb946aa4bd18ffbdec532cf9ac388b28cf3c42aaf6e7f596baa65e262e56ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896344, "uuid": "74b4836d-0ec2-4c4f-9973-4a852b40ae12", "comment": "Malware payload (Mirai)", "value": "25a8f3d46334949fae73d4fb482009594c3d6795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896344, "uuid": "9f17b12d-5c2b-4a4b-823b-725ed8a6827d", "comment": "Malware payload (Mirai)", "value": "f710eeff3de1e960f40792cb703e5dbb755c7b9b63615cb8072bdcd6ef8c122f39a8f04aa92e23ed7dbe04ec2aecbb0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896344, "uuid": "8c929fad-7f62-4950-9ed4-d502f07fff68", "value": "T18C7317C1BA4B80F5D81748709167F33FCB72E6398065C75EEF6AAF25DE336425216288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896344, "uuid": "48cd3745-b792-4473-a86b-c4bc0c44d21d", "value": "1536:Afyae04BMPIN2K8gJWXMhdnogK6hYikUyWb85neJIo0dyeQn:4XCdLK6hiA45neJI91Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896344, "uuid": "25299f93-cc04-4284-9a51-059b6f251f73", "value": 75248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896344, "uuid": "538694d5-47cf-47ae-82bf-5cc3d269ef67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896344, "uuid": "82ba073d-c33b-4082-b3c1-f14285fc0ade", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53b99b1-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937669, "uuid": "d6689761-bf98-4588-a35b-c586e8f716fd", "comment": "Malware payload (Mirai)", "value": "0e5af93227f9581e41e92d6c199fc6bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937669, "uuid": "a6bf2d09-4788-4f76-a6b9-1d279dd6e710", "comment": "Malware payload (Mirai)", "value": "7ffb27b237d33da2ac4a20c3560db2876f5f398f39a0a28dee2d775c7b62ad89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937669, "uuid": "d58fbf20-1b50-4d96-8220-33a207fcd4ba", "comment": "Malware payload (Mirai)", "value": "4030dfe6ee30e70952a1f050e032bce29519cecc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937669, "uuid": "b2db9fbe-9dd5-4df5-8a8c-9538b18f6d1e", "comment": "Malware payload (Mirai)", "value": "c3f0bc26531a978b51519728d1a3a74298eb83d7256d717324b94e8e7b0c57659bee87ab66dcf754c60bcff214f7dbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937669, "uuid": "5aa44890-a52d-49e7-8077-3ce5c516d8be", "value": "T107157C47B2B374BEC157C53447ABCA76A936F46401122E7BA1C4C7303E26E741B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937669, "uuid": "f313d0d2-033f-4be0-8721-1c4b05e142d1", "value": "24576:JPy6QOqsssp4ae/xQqk+LfT3pgmHnpCEv:xisRp4aMk+L73pxHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937669, "uuid": "94c04f3d-32a2-4ba7-a0f8-d7e1df9385ed", "value": 959896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937669, "uuid": "076bdb0c-67d9-4a7f-b63f-dba6d17d91c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937669, "uuid": "8343034c-a86f-496b-a2e1-de90985493b1", "value": "a2work_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e66b91c-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919404, "uuid": "efae11fc-8fd2-4903-a44b-d9455e194850", "comment": "Malware payload", "value": "2597f0f2e220df7e3f9f99fe7a91cc75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919404, "uuid": "1d228bf7-f699-46f2-9039-ca64e6b93a8d", "comment": "Malware payload", "value": "81e8b0938c05d6f993b7b01f5197582b6106be868cc11db84a75a255d8d59b53", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919404, "uuid": "050b7ff6-036c-43bf-9d16-4cfc0fbae81b", "comment": "Malware payload", "value": "8f4837f9accd7585478de3585d99f40db2a96dbd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919404, "uuid": "c74d3606-58ad-442f-9fec-9256e2eeb6c8", "comment": "Malware payload", "value": "9d73d6880201d17505a7eb8b26ae31d091402dd883b48912067c0e1e7109852cf7c1b8251cceea104386c409e9f4c512", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919404, "uuid": "9650bba6-20f6-4538-908d-3f0307d6423b", "value": "T194D309EEB8757B0C348FBA342E0F2E65157C7F77F455D5688860D66253A823027BB80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919404, "uuid": "9da265cb-eb42-478f-8ebf-eac5742f7d39", "value": "768:C8m/Z6sZjWsYuSwnckNuRbI+nFi396pnKxeLScFYHXwz04mYF6F2r:CPXZ6uSEYbvFXpK4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919404, "uuid": "32a21073-e092-4750-a74a-5647e463f65d", "value": 137058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919404, "uuid": "469b2105-503f-41d1-90a6-f3e453802c55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919404, "uuid": "f153122c-0b5b-48a5-93ea-230755ec4885", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c2f4b7-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903814, "uuid": "2a490754-9eaf-411f-8b7a-6458faf933f3", "comment": "Malware payload (SalatStealer)", "value": "d6a7da91e2325810b442beb4116ff577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903814, "uuid": "8ec4c0b6-f871-4726-9fff-222b77f42ba4", "comment": "Malware payload (SalatStealer)", "value": "81ed609bef85ac9426398b401928264296c31ac635438bbb7992a81918394da9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903814, "uuid": "76de25c4-7c71-4147-8867-c12e6d93b0eb", "comment": "Malware payload (SalatStealer)", "value": "8a143d9efaf87c9065150cc085511203a556c9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903814, "uuid": "b9a6d472-8055-4667-9e0c-a7218656dd9d", "comment": "Malware payload (SalatStealer)", "value": "bb2ca31d08e61bddfe80d0c1060675ad6c1ed2c6c456e787ad6a1d59150bdb5681f5b8f48906ee7bb6873012b6b4ea70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903814, "uuid": "49f51d0b-2d3f-48fa-835c-87b521e5bd26", "value": "T174B62321B76495EFE72A8F3A66E5DB0D603D2D395D138208B0B139E10E32F9C79D2635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903814, "uuid": "863a60c8-b07c-47f9-bfe1-28115c048830", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903814, "uuid": "a8c229e9-f5d2-4b96-9337-b38bd2cba1a7", "value": "196608:uk0oUhedRjSUOtyisFHQUOQUOQUOQUOQUOQUOQUt:uk0hyisHNONONONONONONt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903814, "uuid": "b4c92fd9-d1fc-4768-85b6-0a998d3829aa", "value": 11209728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903814, "uuid": "ff5f2b04-6088-4a64-a6a7-d087d2b9d37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903814, "uuid": "4011f820-4cda-40a9-a6cc-2c2750106aaa", "value": "f95jb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0927749-1129-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771900698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900698, "uuid": "4a14f60f-0388-4392-a7b6-dbc8daffb804", "comment": "Malware payload (Mirai)", "value": "1d5c6246d05a1aa4a9376ddabc585635", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900698, "uuid": "a9eeac94-8f12-4a61-bee3-242e137609ad", "comment": "Malware payload (Mirai)", "value": "82211a5394fcbca7c56f9327f20f6f1e24d21b107b42e4f54c89506bfe70ccfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900698, "uuid": "cedaf7fb-c233-4a1e-8a4e-39d7310494b5", "comment": "Malware payload (Mirai)", "value": "1f425527a1d5379e1694f66b1aca69177471a13b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900698, "uuid": "61766391-39b4-4351-9dc6-984a5a4276c7", "comment": "Malware payload (Mirai)", "value": "6552d4b2769b2ab506fae5fd571bcf64ab6ae02a363d9f73cc7e1e9dbcf1f953b8d1bed4aec02cb2800911e6e323cf2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900698, "uuid": "36162f72-201d-411d-a83e-abd34497f6ae", "value": "T137A33A96FD818B22C5D512BEFA1E018D331317B8E3DE72129E205F20778795B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900698, "uuid": "9bfa8921-29ee-4828-8665-853242ecbfc9", "value": "3072:qyNJTGgmlYUjiImkaE5yzd9GlIpg3qYe:q+TG11jiIDaacGIp9Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900698, "uuid": "61e208e2-0732-448b-8318-57649411d004", "value": 104004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900698, "uuid": "cac27e85-9d77-4a98-bf9e-3d418d91c451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900698, "uuid": "5af18f57-b855-47ae-b03a-737f878d94a7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2659acdb-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917565, "uuid": "90646233-e883-409d-b757-f0568d13f0a0", "comment": "Malware payload", "value": "04094bbc647d959ee901fb684afa5fd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917565, "uuid": "511ab417-dcfd-4aa7-a9c0-06c4ad9f9e21", "comment": "Malware payload", "value": "82ceda2c11e19743fc551ba30d3c9c91b24cdc86963276edff783cbc32008e5a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917565, "uuid": "687c8048-d288-480d-ab96-5523af952995", "comment": "Malware payload", "value": "ffcbbf1e1d5901de469b420378d5fd5eec021eb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917565, "uuid": "e506d73f-9f27-48c2-9a43-4ae51ff74766", "comment": "Malware payload", "value": "293a75fe3ffed0fa0c3d382d265d26e1dfc6066226db5b44a58d55868b07d14d922b6f40cd17343d153ebb1916f2c2f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917565, "uuid": "6850b5bc-3549-4d38-a0fe-0b685e14d7bf", "value": "T14ED3D9AB11C1B554283BC0199E60D5377BE1DCBA3EC94312BD17FD108CAD69DA7388BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917565, "uuid": "6d4870fd-70cc-4360-996a-953cd5a51d0e", "value": "1536:CPXZ6uSEYMUkUyUfUFU3UYUbUnUgUbUVUhUlUcUZU9UAU+UUUfUCUPU8UCUOUTUa:CPXZ7Ycp2x4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917565, "uuid": "3bd6298a-d8be-4ecd-a233-3dd36d4bc166", "value": 140868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917565, "uuid": "4e377e92-7646-486c-ba83-8a995622d9b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917565, "uuid": "22d15d13-a631-422d-b775-b263fc7ed45f", "value": "invoice-1645080830.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cee358-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919529, "uuid": "a76e0c85-ba78-4e71-adb0-9bb4f8995576", "comment": "Malware payload", "value": "efd5456296834db940bbe6664f4f70f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919529, "uuid": "a989700d-ad6f-4e1b-8033-a37c6daa311e", "comment": "Malware payload", "value": "8346ad0d8993704ba079c1d4dd9855a69d08f77f597ec3a90db1540fcb221ae3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919529, "uuid": "f6d4e3cd-c23b-483f-ade2-a11a9eca01d9", "comment": "Malware payload", "value": "ef7f1894506675ed7500c18c52a5e5304ea0a183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919529, "uuid": "10ae9dda-0cc5-4c86-ba5f-d054ee7727a7", "comment": "Malware payload", "value": "a0709e0a93506ee63846c92f42b3b8cb4ce72b750f725cf1135db2ef4a0ace78da492469cefb8652568273c7f65b9616", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919529, "uuid": "c5f462cb-d2a6-476b-a4dc-421d8cf5aae1", "value": "T140D3EA888B2C800AA4B2EF343DD18D8AD87E7D145D24C42AEDD1F126D64F6E2F396577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919529, "uuid": "33399f9d-0c3f-4cac-afbd-797891c20281", "value": "1536:CPXZ6uSEYCBvoGag3gytl11cVeZQp32es+WNgbN0hGR07R9h3OFQpstmZYVFQMwH:CPXZ7Ydipa4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919529, "uuid": "0d8aa15f-4536-4c4a-941c-bad2595c0cc7", "value": 140869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919529, "uuid": "859b99e2-e99d-43f2-a0e0-9fc631d00942", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919529, "uuid": "ef7ace00-37ac-44d6-944b-bcf2b793cb90", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fda8bf-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771957340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957340, "uuid": "aa37e3b9-29ad-4b70-8ca0-47a9796768aa", "comment": "Malware payload", "value": "67bf3bbdff98cf3c46d69831cce5ee17", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957340, "uuid": "b28c7970-de50-4134-a048-da6e1fde5afa", "comment": "Malware payload", "value": "851083c6feecac2d7866bcfe6de832fdee5a03fafe603911187cd6976449ec87", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957340, "uuid": "cfd5e81c-0624-4e1e-a8c7-969ad97625b0", "comment": "Malware payload", "value": "ab38997087f3513797e9f3df0f35319c265009b3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957340, "uuid": "d9350de2-18e4-42c1-801d-5bb2b1eb82dc", "comment": "Malware payload", "value": "3b27f0e036d46f50830311eea0d07ac75ca2cb33cb72e5166ee2d0449df04c2cd5ef8d51fdc4a1e5429ce9f87255fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957340, "uuid": "732cfd66-efc6-4e17-b10f-2625f124656c", "value": "T1D9A12A74CA9E2CC4C901C1BC3ADA646F588CA5B803B03772972A9BCD78C4B5309F01D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957340, "uuid": "e332a19f-c27a-495b-a7a3-e4997b64570e", "value": "96:riAIyCCHVFH4jl+cmtc6LfkBYJDD1v5kW1EItQ3+llN:EI4jbW6Yph5WItQulT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957340, "uuid": "7a9c989e-b781-4326-a374-bf98b154c0ca", "value": 4841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957340, "uuid": "e2b419f8-62ea-4753-9209-98e9f1020175", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957340, "uuid": "786ce1e3-03e3-4798-86e6-cab7990dcf3d", "value": "result.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dea58b9-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917578, "uuid": "63d32389-0c89-4f37-a8d0-dcae3c9a352e", "comment": "Malware payload", "value": "e7e808d35c69a3b3cc8213ef8f17512d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917578, "uuid": "3e9941de-4ddb-4235-b760-fedd8f8708f1", "comment": "Malware payload", "value": "86a360209f7ff4ae5a9ab666827048c8d8f45c2f70f91dc5c51359a5629dad6d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917578, "uuid": "edaed48d-28d8-4d60-ba82-cefc694b5737", "comment": "Malware payload", "value": "62b1e03bc0d0eb3b9a6137d9a675cccd2088dfaf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917578, "uuid": "e07ba2ef-df0c-48c7-b189-747813ffdc3f", "comment": "Malware payload", "value": "c05bd7d5c7448c4b80739a0e4a5e88a68e717cae84ddec23078b41d364222921d674bb49685ffbcddb28ab35af588aa6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917578, "uuid": "40fbb0da-1793-4195-8b8a-2e835a5ce29c", "value": "T125D3F867BBE014E12FF20BFFDCCD47855804EEE56E57D4F96B2884011361AAC4ACADA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917578, "uuid": "d6b65f3b-2772-4667-bf9a-095563fc5da5", "value": "768:C8m/Z6sZjWsYuSwnckNuRBNEFWGiriNEChHcYI2q+SeIL9/hiBC0lwMlhLYVwu5c:CPXZ6uSEYoFjWhpr4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917578, "uuid": "2d382823-2e42-4106-ad13-a91562e5b229", "value": 137999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917578, "uuid": "b83c3b40-8934-4eb1-88f1-db026416c031", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917578, "uuid": "d952bde8-72a3-493b-b598-30d81198f038", "value": "invoice-1645080830.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b49bde4-11b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1771960899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960899, "uuid": "d38b2655-0cce-48d7-a9d3-55e911ff4f71", "comment": "Malware payload (Smoke Loader)", "value": "034b03b9fee7665521b6883817c01369", "object_relation": "md5", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960899, "uuid": "f285e127-f2a8-4abe-9aab-cb2e6db46674", "comment": "Malware payload (Smoke Loader)", "value": "88b9d60764305345d87dee588611de9e9c5bfdbb46d04af61d329112000b098c", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960899, "uuid": "02f3488d-3048-4509-abde-f794034b3945", "comment": "Malware payload (Smoke Loader)", "value": "c826519149c2e87f070a396ee323600ecda8dd3e", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960899, "uuid": "2a46bac9-b9e6-459c-99ec-50b8aa3edc51", "comment": "Malware payload (Smoke Loader)", "value": "266ded7dbfaef7fe91729b6b73341affb8409c4c84b1ad30f49990c7815900d0ef53e4ea34a3796f2a60652aa0d2f860", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960899, "uuid": "dac7b70e-f7f4-410b-a368-2fc5791c916b", "value": "T13677BE06B7D840A5D0BB9238C97B5766E671BC25073093CF2254BA6D2F73BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960899, "uuid": "b8be14e0-0255-4510-8887-92cf966fff32", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960899, "uuid": "833f96d0-04d7-49f2-9c31-5feda4c164e6", "value": "786432:Y7xJVCiaUKBRVqnyu7Xe/YUCJyEc7AzmLx7Sf:+JVT7n3juEc7AK9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960899, "uuid": "09018140-823f-422c-80f4-a9e1b22df1de", "value": 34921472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960899, "uuid": "485ebf11-0dc6-439c-b997-b62f7660b0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960899, "uuid": "0483f7bf-161a-4810-a56b-940914e7ca45", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a88a38-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919334, "uuid": "af75da6f-1629-41ab-b83f-46b9a37807fb", "comment": "Malware payload", "value": "b1f0ed2af48f8097ffccd473d06df143", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919334, "uuid": "9c9ee3c6-b0fc-4ec9-93bb-197702917252", "comment": "Malware payload", "value": "898cd0d575982c46422fbaac0dbc6442ff81c617b567315baecc7bc885c8017c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919334, "uuid": "2b160609-8bcf-4433-a0b0-ecc8b9fc96ac", "comment": "Malware payload", "value": "a58b6cd25baeb636e7a1757a5017a2d28ef565ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919334, "uuid": "e80f16df-0ede-4f73-bc58-a432c13b9bd2", "comment": "Malware payload", "value": "19f23d39b3ca56a04ef2151158b6d8fef234386db7b4f6366cf693fea1526c8ab733ac910f33fda5c17fde9f3d9f33cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919334, "uuid": "c24e9490-afbb-4de9-bb8a-5470b62f5331", "value": "T1C6D30B461D55C26F24AAFAB5C27393C040F795ED0E943A769B3EDA702DC80A27C931F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919334, "uuid": "9a493b6a-f0d9-45d1-a08e-867b74ebb495", "value": "768:C8m/Z6sZjWsYuSwnckNuRUFnpco/Y0LxeLScFYHXwz04mYF6F2r:CPXZ6uSEYUFnpf4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919334, "uuid": "00d8678f-4601-43fa-953d-054642155a79", "value": 137032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919334, "uuid": "fb51be95-784e-4e1a-9c86-575afff81a23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919334, "uuid": "248fe3a5-a575-4b47-983e-00ed8aaec141", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32abbc2-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919546, "uuid": "6023514e-e3fc-40be-8d69-db4d90497691", "comment": "Malware payload", "value": "fc7b7004ddfabe1c1de83d9ba115425c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919546, "uuid": "3e348ed1-3aaa-40c3-b035-6010d2724bb1", "comment": "Malware payload", "value": "899914377e210e90b50f9c014c5b457546b31325d7e093f0a77798ba47f198d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919546, "uuid": "3bad3651-aee2-4437-81be-fc17f21e26e5", "comment": "Malware payload", "value": "fd5478fb3c64487678891feaf5939a371b890306", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919546, "uuid": "cbb8c4a2-129a-4d64-835d-ae530da1ea78", "comment": "Malware payload", "value": "2dad9c0531f4ffd90862296f342a0c0cb8443795ec6b0c006f556524b9d026a9ec3e8961ddbe7c6bb4a4ddfb5d6407ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919546, "uuid": "4eeb7aaa-23bc-4cb9-92b7-0cfd95051428", "value": "T1F3D3E92609D7748E6CF4D8B86B117F464AE73F49299B38C923B106EDE4147FE022D5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919546, "uuid": "b58c3032-6c6f-4064-bb94-0d1e0881bcfb", "value": "768:C8m/Z6sZjWsYuSwnckNuRncBcucJcIcEc9cqczcMcGcHcFcXcicicpcOc/cTcUc7:CPXZ6uSEYhp4F64YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919546, "uuid": "a4065413-91e0-48a5-b525-2702f906ac4b", "value": 140888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919546, "uuid": "d4a76a24-1e83-46ac-aed4-52fb72d98e2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919546, "uuid": "40ad03f8-cb64-4228-bb3c-4a6e73967e6f", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d1ec45-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771947515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947515, "uuid": "dc7848fd-677b-4a65-860c-645a258abfc5", "comment": "Malware payload (CoinMiner)", "value": "858185cf4f316fe49424cb11b6cad295", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947515, "uuid": "3114982b-1a3d-4ad5-8b4b-5c65dda25456", "comment": "Malware payload (CoinMiner)", "value": "8a248046e3e5e81b40f42fe8fadfcf25696d9ae6853879303137e99f584f0ea6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947515, "uuid": "1a691978-f089-4d30-99f3-14d9924e9514", "comment": "Malware payload (CoinMiner)", "value": "9dd3fb274899f94aa8839165909d2f39d08ce2d0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947515, "uuid": "da10cdfd-3d7d-423c-bdd8-c5c2dea54b06", "comment": "Malware payload (CoinMiner)", "value": "b2d2984689a6cdaeef44bf2191ac191bfec76e9330cf7858910f8e9e0e9c040c602fc9062c1eaccae7a0da040fcb34df", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947515, "uuid": "e2da81a2-ab27-47c4-9d0f-c5c3a1174b39", "value": "T106B66B6BF1A710ECC56BC171825BA772BA30B81801347E7F2A64DB712F21E505B6EF64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947515, "uuid": "b444a750-5836-4bbe-bae4-5021a61a91e9", "value": "8a6ff128e9227a5c35b5eba6ec011184", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947515, "uuid": "33d1a6d2-e0cb-4ec9-8025-c40cbe49856a", "value": "98304:EdwKQd9UAyk4ZcprPX/fAFYSOlUXdFggD9ZXETm0pQCMyCHCtz3oZ2WfVMsIzC2K:rcNp25zC68F5B/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947515, "uuid": "9b4c6c3e-6eb2-4aa6-9ec7-a1a93cfa1d63", "value": 10784256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947515, "uuid": "3d778269-96f6-4088-aa5b-08261898eddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947515, "uuid": "419e8913-246a-4cc6-b0f1-dd5bd35c563e", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442ae726-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921481, "uuid": "48ba9458-5840-4ab8-8226-34db152b5cce", "comment": "Malware payload", "value": "1c4200bab255bc6b0515d2b694eb9dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921481, "uuid": "ea9df85f-8111-487f-b35e-b5176aa65067", "comment": "Malware payload", "value": "8a4044de9f846dce4651bff1f239f617b5804739d591fff4eeb9e03a8de49549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921481, "uuid": "e46c7265-1fc5-4c14-90ad-adb1a6d69875", "comment": "Malware payload", "value": "ec92fa99d05ca8faa4671da2918527aad81da8c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921481, "uuid": "99ca38a8-5035-4eb0-b028-ccefd94a246f", "comment": "Malware payload", "value": "349fb0a87c45c017e31d7adaf240575e3421a6ead7f14629832c1f69ef76380e37669c5012e5085a1aaba532bc4329b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921481, "uuid": "3e166412-9062-4b77-b38e-fc556d473ee7", "value": "T175361897B8C24A82C4E4367AB87D81C473635EB99B9756576D04FE3C3BBE1A90E34700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921481, "uuid": "98434323-4591-4590-8d9b-7d44f1a552fc", "value": "24576:yd7bb70/cInRinno6XvwtOUJUstDMPIp/uHsyHO3XO+Yt2wYggg4jDGgHVNO+L/r:yvMfRJ2Ci+Qq9rM9JKG/raLim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921481, "uuid": "f8cebcbc-5279-4c0a-bd19-1166bc23a141", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921481, "uuid": "a3615aa8-4c56-4a1a-bcf9-63063e9e9346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921481, "uuid": "85024c21-4e43-4aa2-ac95-f608c124e4ba", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eea5ac4-11b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1771962274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962274, "uuid": "1775ac5b-0785-439f-a7a3-f4df9c609830", "comment": "Malware payload (Smoke Loader)", "value": "46df524510ad40e83979108a1a8ad109", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962274, "uuid": "dee6c92e-6ed1-43a5-97fa-755a42c756bb", "comment": "Malware payload (Smoke Loader)", "value": "8af75100ed69758e4da91255e0fae90f4ac40db2d1cfe52b9ea90c637ea30a82", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962274, "uuid": "609f105f-9122-4d28-8067-1abcd81609bd", "comment": "Malware payload (Smoke Loader)", "value": "5d512c94f40f4979ededbcbcbea634bdb3fd0368", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962274, "uuid": "1028d910-d180-4d44-9ea4-ae691b2a9eba", "comment": "Malware payload (Smoke Loader)", "value": "3c173119d48d2a55d1033015d542ec0c37eac6eb78a5fd68018f6f5535ca0976f6ccca4dc81c96829e68273772419eda", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962274, "uuid": "464a3caa-0246-4524-b75b-3d1cad62524b", "value": "T1CFB538867D83A8E5C06A9635BCB256BD3F70BC3C0B3223CB1B5876382E366D55975708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962274, "uuid": "2e713f01-6668-48b2-b52e-51af48b974a8", "value": "24576:9tLcpVLxg7FSN+d6yBNRhr36LzpHcuxL/reQT2sN16LtP3iH/hdEFWgm:MpxxESN+MynRhr36L2uxL/dx6Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771962274, "uuid": "1e8fc498-2d2d-46f0-a6de-5c14ff9af3e5", "value": 2486272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771962274, "uuid": "6bc85b9e-c1fa-47c6-8f97-58ec55dac2f7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962274, "uuid": "4e68a78c-2fa7-43f7-8908-bcf694b0710c", "value": "lRQklBTb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2102bcfd-1189-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771941608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941608, "uuid": "7c7b2a2b-f810-45eb-a954-2f7913df9ee3", "comment": "Malware payload (SnakeKeylogger)", "value": "39bee76f50ed44262b8c35aff1ab2bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941608, "uuid": "da5e809b-20fe-4f71-a1a0-36742e541b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "8af7ef34bb470017a39d739fcb1a0be4f538783599e1f4cceaf7403ce262c71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941608, "uuid": "e65e6f89-9e8f-4628-9ea7-78a8199f95e2", "comment": "Malware payload (SnakeKeylogger)", "value": "9466d209e326a1a36701d863da5db1d1395017fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941608, "uuid": "2e0f4c61-272f-419b-b1ea-32be87f346c6", "comment": "Malware payload (SnakeKeylogger)", "value": "a4dbb069f4a484c2b0d152c15a480e408d48180d98884fb5c9638dc9ae83d490d4a7d7e448714a475608f45f6022f19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941608, "uuid": "d4a0f926-0267-4bfd-ada0-d7e82d2a7dd1", "value": "T1BAD4229659D0A954C2546730C836CC61867839306D1AB33FC36DE26E7CF03D39A67B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941608, "uuid": "5f22e0ff-ca99-463d-ad61-f3fcd73212d0", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941608, "uuid": "b741b0bb-3f14-4242-beed-8af267fbca72", "value": "12288:Dz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDhTNRs9LW5vgGTwPVfK5r:Df+iN57Gtene3BTsj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941608, "uuid": "f83f40c1-71ac-45cf-aeb9-1e8b44af536e", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941608, "uuid": "9a9d436d-eb7c-4bcc-86e4-2ddf20f28ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941608, "uuid": "2aef1027-f981-4b6c-9df1-b34580f25732", "value": "outstanding amount is.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5d09a4-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939188, "uuid": "77d8e1fc-07ec-4b64-9cdb-6d0d7fcc81a8", "comment": "Malware payload (Mirai)", "value": "747b7bbf1cca3d954a665c52fc44e472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939188, "uuid": "f4a29b15-73e4-460f-9255-a77929f8f52e", "comment": "Malware payload (Mirai)", "value": "8b0398d69ddf75a47458ef4e98b8017aafa86f1c1e63e938f141160bb2b005c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939188, "uuid": "d8a015a7-6520-4319-a476-daf5ea03beca", "comment": "Malware payload (Mirai)", "value": "273a0f69e5417b42454ed0ad93721204154cbefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939188, "uuid": "d0a52b21-6f90-4141-8a4c-05a035e7b0e6", "comment": "Malware payload (Mirai)", "value": "1c5ee2450383f1a63a4a3b702fa7c5e7608d954742b5d4ce2a62bc601bd560be60b5cd5e27a4a5db45741bf3a6548f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939188, "uuid": "cfdba176-844b-45ef-834b-6a56b8fa3c94", "value": "T11CC33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939188, "uuid": "10e5cb50-2b20-438d-8933-827ed58a36a0", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmoGHzNzQSRN6Fpjygyjc:jrguLRkHQo8SsGT74p1oB4n2pvalABzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939188, "uuid": "4593159b-9a2d-4920-8682-048447527f5c", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939188, "uuid": "243690c4-8ea9-4ae7-9e5e-9f4b460b6480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939188, "uuid": "90ae20fb-225c-4bfd-bf78-73ecb3bb1e10", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be028e70-1154-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1771919108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919108, "uuid": "1dbf9d4e-7a95-4986-a381-209814042853", "comment": "Malware payload (RedLineStealer)", "value": "3dcf5e9d7df3365e8c33641790b465cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919108, "uuid": "8c185b9a-49e2-43ef-bae8-e3a4241d020f", "comment": "Malware payload (RedLineStealer)", "value": "8b052861fba7933b8963bc3fc428dd51b549f07c985fda693afe5ea2ac39cf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919108, "uuid": "7dba5a40-6f15-472c-9e8c-d3cfdb175111", "comment": "Malware payload (RedLineStealer)", "value": "f52d62e150e49362e5112c187ba063f7408abe2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919108, "uuid": "8941be7e-f422-4c25-ab32-8365a4509681", "comment": "Malware payload (RedLineStealer)", "value": "e945fa03ddf21e655159341de6730d22b1fcfdec49074ed0c4685be2ac846ba80b0cc64b8ec99dffc3494eda5f7eeb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919108, "uuid": "0279a197-a930-4451-8e4a-e9946e17f91b", "value": "T1F3151230639ECE2AC4ED07B94871D33813F68D6EB112D3478EEA7DEB79967C24944612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919108, "uuid": "fea170dc-81fa-4558-9814-c6e5f5339218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919108, "uuid": "297b4fcc-2612-4199-917e-351ab715c07f", "value": "24576:HzHpguQDwTzegkDe6PPCmPK3JPpJPh++UvQdgdUgVictow:HzHmuj2gmtORLUvxFQc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919108, "uuid": "bff89378-bf45-40ee-a499-9af0b47c90ff", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919108, "uuid": "7f00d930-9645-4322-891d-0efbcf5409d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919108, "uuid": "95d15d6d-618f-4745-b443-3cd78958e869", "value": "3DCF5E9D7DF3365E8C33641790B465CB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3768cb7-11ac-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771956994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771956994, "uuid": "2fab676f-b4ad-4416-899a-2033bbb17005", "comment": "Malware payload (njrat)", "value": "d04989eb795e62120414bb7e0702b83a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771956994, "uuid": "ceee8a1f-b1e9-4051-a51c-229c2b257a9b", "comment": "Malware payload (njrat)", "value": "8c29f215f69a89cd75ea77a8bf73d75dff441aedfbd89bcbad57f652ed31ac1e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771956994, "uuid": "e6b449b9-7315-4e8d-9b0f-9de62c547d83", "comment": "Malware payload (njrat)", "value": "a96c4b2403b1962e2bab291865eb6cafc8fed950", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771956994, "uuid": "b80dd4a2-9d0a-45c9-9749-4491c0756fbd", "comment": "Malware payload (njrat)", "value": "16311fdcb8c2c78b8110504ad1717ff9e5bd52ac1184a0d97c2c41eb5f6c3ba7c3564cdcdaffee41eb3006ce58305b2c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771956994, "uuid": "f467fe87-b995-4d06-ae71-fcc7a1b3ca65", "value": "T1B12423F8DE016A5EEBD0758285313057D41C2D3B2CAE11B709A6A2256EE43F788FDCE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771956994, "uuid": "2d96f74d-2d2d-4d70-a71d-a2d2f1363e96", "value": "3072:bBrck7Nx96/pACagZ9o03sUyAdr+lAj62p+ojbwGwrVnywVmu6Qv3s6Spy8bbz/6:bBt9K5wyfklffMwGcVymRv3LtGn8Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771956994, "uuid": "c7efae49-866c-4ef1-ab96-867fad906014", "value": 223986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771956994, "uuid": "94bd3437-b10f-4526-a9b9-fc13a354454f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771956994, "uuid": "e8e53516-0ac9-424b-a2bb-05e75c11da71", "value": "24022026_1434_n0oav9.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7ce3ef-1121-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896930, "uuid": "8be0eafe-9985-4b8a-9f63-a91f04741370", "comment": "Malware payload (Mirai)", "value": "9b75ae424421c60c9915a92a506b69e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896930, "uuid": "7fd62666-28fa-4f04-9fd6-fec417f5c819", "comment": "Malware payload (Mirai)", "value": "8c52016acab3812686ebf0da44a812f0ad6e8b3ff8fb9d703be2ba840527e5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896930, "uuid": "87628688-2844-4683-89b3-bb9b38d2cfa6", "comment": "Malware payload (Mirai)", "value": "bfe8c2644eac9de4f45f4ffbec27d9bc940d6024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896930, "uuid": "7850e45b-559e-454e-976f-0a16d5989caf", "comment": "Malware payload (Mirai)", "value": "ab7f0d0a5e42f9af023f6f55a27ac5bb83c7db0a7d5ab538dee1ca4ba7cb2c09682a3edb48f56a91c1c91550d943dec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896930, "uuid": "8c5c2383-3bd7-4a23-a711-f824e0fb2663", "value": "T1D843F895BD824A67C1E013B6B75E968D33A163E8D2DB7317C8204B607B8A90F0D77F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896930, "uuid": "e4077fdf-b186-4b2f-8c9d-c1a67567374b", "value": "768:tQora9HxmfiniZ3M86rvTD/NqTelvOyAm7sQVPtjvOwC8Fo1tVwd:URmfeiwD/wTelvhAQsEtj48s4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896930, "uuid": "fa1db69b-851a-4f73-82c1-2448d349f078", "value": 56836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896930, "uuid": "9f2ce933-9559-43d2-9c68-db86519d5df6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896930, "uuid": "c666b552-d638-46de-a797-5359d66dc9b8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688eaee7-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939151, "uuid": "d0c11698-edcb-4ede-a066-c27af4fb0c9e", "comment": "Malware payload (Mirai)", "value": "a9b1ea1e16cfd42c2d95ebf7728a66cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939151, "uuid": "c0616b64-5720-441e-87ca-ff9ea7571d30", "comment": "Malware payload (Mirai)", "value": "8cd02cc6d151d4f3380abc590ab499b29ed57472a13c5a52430b1d4c5b402113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939151, "uuid": "a88afe62-131c-49f2-8d75-4f23d3516c82", "comment": "Malware payload (Mirai)", "value": "fd81f32c3fab22baba2bdea29fb3e69bd0eced1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939151, "uuid": "5ea4cfb7-5f95-4f7c-a96e-1c37f99613e8", "comment": "Malware payload (Mirai)", "value": "5eded701ec48f4ea67ea32e9e3ae4f4fa61d7c69fd559da18c303052d47b2c3b1144ec2d2b1e97b49d63450c456915cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939151, "uuid": "695bbc42-4fd8-4d5a-9539-6b6db6169bf3", "value": "T17BE35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939151, "uuid": "2a63c950-85b9-4b32-8a83-0f072b063ade", "value": "3072:7oDlIyA+oy+ZGiTW/lZoEhH5lgLOoe97dlJ8jh4:1Dy+ZGOEFxoe918jh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939151, "uuid": "fc71c3b8-f640-4e00-9669-ffa0b7233a1d", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939151, "uuid": "3bb7509e-ab70-40ac-82fb-cbcdb34be274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939151, "uuid": "c28674a2-0aa0-43df-be53-ed861d84ad6d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8f4855-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921522, "uuid": "8c471954-3d50-4c9f-8cfd-1dc1101e7090", "comment": "Malware payload", "value": "a21b1ced84e07c061dbb17a571332ff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921522, "uuid": "ee80678a-4ec1-45d7-8cb6-7ebc5e73c29e", "comment": "Malware payload", "value": "8d1d557df1dc980d7df738f4b70dc39c6e38ee20d1856f48d491a7a4ffb98a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921522, "uuid": "ff5aafc7-1955-43bf-845a-03c22cc23a98", "comment": "Malware payload", "value": "77048ddbe2dde4519efdf34be67577a626f560cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921522, "uuid": "13224586-95f0-4097-8989-ce76de066f17", "comment": "Malware payload", "value": "39884ae3bff499fddc43e86f8610eae839166dbe3f6556eb383f270b94936f7405f75a471d54af922ca5b21d743841a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921522, "uuid": "da7c039f-c569-4886-bcf2-5fd9861dbe37", "value": "T1174619527F94EE1BE29421358AF6C23433D53E0582E421339612F71D2EBB2B49D5BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921522, "uuid": "4f6f3c7e-7fc5-4702-9c56-f7e438371111", "value": "49152:Pfk83KR7cfBf/xpkV3+xqaSmXqzrm36ivHH:PfkIE9Vzrm36ivn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921522, "uuid": "eec6ff8d-f6d4-4a4d-9382-9c7c1c039351", "value": 5832704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921522, "uuid": "4f3a290b-d48f-49ec-bd12-3e7e09b96417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921522, "uuid": "8bb966c9-45b4-46ce-a7cd-3b20c42a36bf", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592dbd82-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771963177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963177, "uuid": "a7f8d911-2aca-47d3-9b11-20da01c0a10a", "comment": "Malware payload (SnakeKeylogger)", "value": "b06c4d73b5218a0ea5b61edf8b78cefb", "object_relation": "md5", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963177, "uuid": "f0daf72a-d1a5-498a-8db8-d644fe4c2672", "comment": "Malware payload (SnakeKeylogger)", "value": "8e5182bb2280d911b1ac376c1470920848d73280c7ccb72d723b291bdcb048d6", "object_relation": "sha256", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963177, "uuid": "5a2326c9-c472-4a5f-84b0-61a5faeff207", "comment": "Malware payload (SnakeKeylogger)", "value": "3aa8514b00613295df99b7e083b78ce1cc3c8d63", "object_relation": "sha1", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963177, "uuid": "e913c30a-4551-45f7-81a4-4f140d601187", "comment": "Malware payload (SnakeKeylogger)", "value": "a89fe60123648f90e2bf124c7f94abc5b2fe08a1eed354deae608b6ae4ac13ab61c9d81502c1714e496d2d814467b18d", "object_relation": "sha3-384", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963177, "uuid": "588483eb-2a1a-405a-89d5-264fca00ee3f", "value": "T13F4474092BE8A801D2FF847783B65125C6BAB45309658D3E1BD2F81A3F3E544DE46F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963177, "uuid": "00260576-d5f9-43e1-9a78-e5af4e647bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963177, "uuid": "c57b7d38-f20d-4757-a639-c6f29b3ac5d6", "value": "3072:OaOz0UFD7q39q7Qp7B4CPth86q0XCyMqRhT51t1huWv799vpbf+miLbYTKBg9ikg:im39q8pjbFT99RbAGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963177, "uuid": "79ea0b9e-b03b-4011-9394-2f66f652443e", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963177, "uuid": "a0ff71bf-700d-4b50-ae21-e08edd407787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963177, "uuid": "f83f777a-5d59-4339-9e07-a0c6b88a8437", "value": "latsnake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c604220-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947399, "uuid": "21139529-58bd-418c-bee0-0c58b9b06c13", "comment": "Malware payload (AgentTesla)", "value": "d420e4491afa3188452444698f89973f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947399, "uuid": "c265acc4-dfca-4e2f-958c-67817c8dbc8c", "comment": "Malware payload (AgentTesla)", "value": "8eac663c2da5748fad47104b0fab2e7e9bb9acfb56ce58097df9d0995ea5a9ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947399, "uuid": "277cee9f-823a-4ccb-8d55-fb6ae82ca96f", "comment": "Malware payload (AgentTesla)", "value": "6f285702a41c0da11df9e1596ec3f26b60d7c879", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947399, "uuid": "af4e685a-b92c-4ded-a589-2319f55132a4", "comment": "Malware payload (AgentTesla)", "value": "0b3bb05db4a57757efcf0acf4fa715f27ad7c8e8fc0bc53c9ede1e47fdd845f25a649c9db9ae7fbb100d15f09ff6f501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947399, "uuid": "fa6e5528-8eaa-4ca3-b76f-4644971f88e8", "value": "T1F24533A523F1C92BEB352638E6F018F5C739BD15EA5896278F7C7E6C7173102A0442AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947399, "uuid": "3b2f02ba-682a-4e00-873f-ccaa69bd1650", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947399, "uuid": "aba88ca8-98ef-4cf0-9d80-de86eb31c36b", "value": "24576:LoLLF0f536wRnaBjjk5W9L/hdc2fFQKYHLh3gY8G3GEkaWqet/vfZBuxvqvG71P:LQLFtjk5W9h3fFQKcWRG37kdqq/vBBuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947399, "uuid": "3ea7d4f8-2c51-47ca-bdaa-f57cd0d4fee4", "value": 1213304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947399, "uuid": "da2c54b3-9f59-4267-9400-d30c2035c3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947399, "uuid": "1aca10df-5e5b-43f8-8a0b-66e8a97706ed", "value": "ODEMEDEKONTU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea8c56a-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919512, "uuid": "b52789bd-1692-4689-bc4d-f65c3a07dabb", "comment": "Malware payload", "value": "1d2f8f0fdc024aa34dc9549ffd9d3b3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919512, "uuid": "2e5266bd-fd3a-491d-8fb1-1ce7da93fb4a", "comment": "Malware payload", "value": "8ed5125adff62c9d00f0f21c29bd299b200a215b82eb3278c4119e6c6ab43914", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919512, "uuid": "9b65e1aa-b21e-4348-bad3-75b1b9f6f2a4", "comment": "Malware payload", "value": "e8504f130208ced93c91c0bb81d22b3688e7d7d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919512, "uuid": "7f3d9479-e2e4-423e-b962-03b7a8adb047", "comment": "Malware payload", "value": "8332115de622cbd4ef0f4312e3fc0d53a66166b1cd31ad39ce62a6c1fdc8ec9b892b65c0769e433f283df4c52ae9e53a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919512, "uuid": "9a6a88b0-f6e8-4023-bc5d-b89cd5c699ae", "value": "T16ED3F89772CEDC76A968F337E268383BA93BE354C8B3F896F0900D9799115C1D806653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919512, "uuid": "0a636ccc-695c-4a7f-b4b5-87f0186b010c", "value": "3072:CPXZ7YLMpP8W4Dpggfyrt+XWOp2np9eo7QOWEtgG5/q8HpTGd8In/BEKVQOw+08m:E0MpP8W4Dpggfyrt+XWOp2np9eo7QOWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919512, "uuid": "2b7e97c4-faf9-4d2a-a84a-c48359931688", "value": 136088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919512, "uuid": "ef0459d5-c2f0-40ee-a1fb-b3c1ba27e426", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919512, "uuid": "068195a7-298a-4709-896d-0350cf47f191", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec8c91c-1193-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771945899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945899, "uuid": "2602a336-82ba-48a1-bab1-2fec17ad257d", "comment": "Malware payload", "value": "76a855a60af4c4e74eab70ce6b2ea2d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945899, "uuid": "0074d77f-5c05-4408-8326-032b02e0e852", "comment": "Malware payload", "value": "8f72eb87e2c3ba8448cd76095d1037a7127a35eae0cb03dcc00e6fa2505a2d22", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945899, "uuid": "0a41fc90-06a8-4942-943e-b46c089575c7", "comment": "Malware payload", "value": "8c21d366ff033558471758bf94b31e3450593f0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945899, "uuid": "10ac46fb-c718-40a8-b192-aaf7d23a5cc3", "comment": "Malware payload", "value": "87505fd90704ae9e939fd203bb8651e96aef0ed14e35f3ec6da1e9eb9cd9486a9584d75e7ab891bede03a244b5ad5419", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945899, "uuid": "0f85ae58-ab6d-441e-937e-bb08fea351fc", "value": "T18D76131B491D00F0866A6B1C4D6173DCBE19E3D39C6116C8CB74E3DAD4A6E7473EC2AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945899, "uuid": "330aa6b7-f3fc-429b-918d-06ccd6ad3394", "value": "192:JbvEqn52xOLNGOblkajY6qlpcJCfMpN6vGru0IQPe6I+ZXVC0ThINCPgy8FAbnfN:LSFOuIMnNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771945899, "uuid": "7a662c30-adb5-4677-a21b-e21ab7e35488", "value": 7688035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771945899, "uuid": "714ddf4a-8fb5-4ba0-bca9-00f0592f2050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945899, "uuid": "e9449e5b-9c59-4c93-9a96-bf71c6e3762d", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916172ba-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928912, "uuid": "9b627e4f-4d4c-4b2f-abd6-9e92f71afcc4", "comment": "Malware payload (Mirai)", "value": "5f47786af37c05ef9401e565d2e0bb9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928912, "uuid": "96131103-34a8-4ce3-99e0-82df6fbcadf9", "comment": "Malware payload (Mirai)", "value": "90f9ec250ed55d6f2e66b58251b34686e35282f17a0c16448b4c252a77294bf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928912, "uuid": "bbf970b7-fd5d-4407-b2b7-fef1599be417", "comment": "Malware payload (Mirai)", "value": "b3aff39ebda7a2574fdef8705ffc4a01d97202f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928912, "uuid": "05d275b2-5dfc-41e8-bc9a-421052248c40", "comment": "Malware payload (Mirai)", "value": "36b1a3ef857400bbbef38fea7888d44d247e0117e45665049c063226035d809489e0cfe228f01668e3e60278f77b83a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928912, "uuid": "256ebb94-708d-481d-a002-ad758ed0f31c", "value": "T110132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577136C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928912, "uuid": "e27b4a87-f4f0-48e8-9f63-ccd55af04e1c", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCwfoOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928912, "uuid": "7cd8db43-f4cb-46cc-b7be-a4aa97596ac3", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928912, "uuid": "7ff97a56-4bb5-4dcd-95fd-0cec8d257859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928912, "uuid": "71922f59-f77a-41dd-a5d3-ab207bd22006", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661f8844-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919390, "uuid": "77277b01-992c-49e0-8e95-216f6e4928b5", "comment": "Malware payload", "value": "7806bb8c8c3db3fd5ef2d6c480c3557a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919390, "uuid": "e908b7d5-2f43-4162-a529-cf30e76ac644", "comment": "Malware payload", "value": "91e5b80f16c3049a2d7b9ea2e34f2c646193aa2c3cffa342333685e24ca44aaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919390, "uuid": "fa9d2a7a-5a5e-41d6-ad41-27550f4e2228", "comment": "Malware payload", "value": "904296c5ada7aa61b01f05a9ac6a6f72d5bd106f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919390, "uuid": "38e8ed97-8015-492f-b869-79b49a2b4f8b", "comment": "Malware payload", "value": "420d3f847e11b33c5ba5b4caf64cbaed61566bed53dd3cf92ec806c0c3ca46eed15eac5ee875239ff43af49bd19371a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919390, "uuid": "7417e4d0-56c4-49ec-a2cd-e6f53c7c1d62", "value": "T1D4D3E9039AD647644A250F7C19D147C7453AB7CF28523EFF0BAD29E112AA5EEB8708CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919390, "uuid": "8eddedb9-abab-45ba-b96a-955d0706f951", "value": "768:C8m/Z6sZjWsYuSwnckNuR2cFh7D6cpdMdxeLScFYHXwz04mYF6F2r:CPXZ6uSEY5FBWcpQ4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919390, "uuid": "a20be820-9b18-4712-ba20-e0cbd1945094", "value": 135113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919390, "uuid": "1410cd2d-3b25-4b3c-a77f-4964e5953906", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919390, "uuid": "78f94b74-9430-4b3e-8de9-34921d91056e", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca88688d-11c3-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1771966803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966803, "uuid": "8ba49a9b-b68c-44d0-8d23-f54ce4515f8c", "comment": "Malware payload (DattoRMM)", "value": "bbd648c8184fa522a8f512546cf1ab46", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966803, "uuid": "f3b1798c-6b18-48b8-abdd-0452f3ca60dd", "comment": "Malware payload (DattoRMM)", "value": "9223a9c39a97e805364d1600499e94f82037b3d16df3f4546695fb345723e62d", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966803, "uuid": "23e55208-d21c-49d6-b7e8-da8e860b9d56", "comment": "Malware payload (DattoRMM)", "value": "47acc93d979511c4cca1df3a99d6e32c03e17fec", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771966803, "uuid": "b11fbd93-a10d-445a-9277-eeba243c2a9d", "comment": "Malware payload (DattoRMM)", "value": "8433d2906248c2b6c14d5a2badc43f754099db2f1e36a05382bcf56092f5c37e845ca6751396c8c7f8a27774c1b3e2b4", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966803, "uuid": "2f576550-2131-4d31-8cd8-b33283b340a8", "value": "T11CB63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966803, "uuid": "8d458d1e-bd3c-4ccb-a81b-d8b02750a51d", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966803, "uuid": "68d144fc-8999-47ae-8db5-4b04a9b98676", "value": "196608:yaZk+waP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:InlmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771966803, "uuid": "9ff053e6-9d77-47b2-a45c-b16d175b1c85", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771966803, "uuid": "9b552925-5e9b-41ff-ab2f-c1d22fbec312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771966803, "uuid": "05292624-a1de-4bbb-8e96-7caf667bb390", "value": "openevite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885d6ebf-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771963256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963256, "uuid": "83d3a8f1-f4e9-4029-b8b4-18355f24bf76", "comment": "Malware payload (AsyncRAT)", "value": "9254126cc2df1a4c557232900085e430", "object_relation": "md5", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963256, "uuid": "37ecbf87-f5a4-4ac5-891f-c782c9f94ecb", "comment": "Malware payload (AsyncRAT)", "value": "9227ea38d5dd9eec65d35ce4ed5b1b0f46856cb2d367c76e29a6b307f552a670", "object_relation": "sha256", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963256, "uuid": "355d3e94-f75a-40aa-86be-7d7727074804", "comment": "Malware payload (AsyncRAT)", "value": "c595c087c3076884db106ee30ce0ae41472c25e0", "object_relation": "sha1", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963256, "uuid": "53ced746-dd51-4ae9-91aa-f6a962764061", "comment": "Malware payload (AsyncRAT)", "value": "3286c7c2f07ab0b59902a87dd10c12d4356825a27aea2c9a73333725e582e8290a40e35137105071ecf0f40390c207bc", "object_relation": "sha3-384", "Tag": [ { "name": "158.94.211.63", "colour": "#720DA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963256, "uuid": "f6d8d3b7-fea5-4f72-944f-73faba8e7862", "value": "T126F24C083BD54229DAFE7FF95BB366021770E5078A03DB4D0DD8899E6B27BC589007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963256, "uuid": "219c05c0-a3ac-416b-89aa-65f90b5b6b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963256, "uuid": "58bbeb06-55a0-4ce3-9d5b-470592bcb5b8", "value": "768:b6KkDnV2jZgWSVmj+51TnYZ/Fn9iv6TOMh73z:bfb8+wtnY1Fn9iv6TOMND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963256, "uuid": "31a9b651-77b2-4ee9-b9e0-47e5bda0bffa", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963256, "uuid": "8141c80d-24a3-4f15-a8c3-b3f8475a1d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963256, "uuid": "797936bb-741e-4509-b891-24f1a82c9007", "value": "oilandgasxwormugo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dc8b81-1182-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771938830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938830, "uuid": "9d0f8262-4d87-4505-9f6c-949692a8e9a9", "comment": "Malware payload", "value": "3957b89ce4e207fa338df4381e6b1326", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938830, "uuid": "2341aa6b-0c6f-43d3-a7f4-7cc88ab527b8", "comment": "Malware payload", "value": "93282e12dd190c462c9f7c1394dd18194773c3fbefe76f8972a7369e1d976ac9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938830, "uuid": "8efe613d-4e52-45e3-abbe-08c2c7eff8e9", "comment": "Malware payload", "value": "520cf9cf1e6fa20fa5ac40ba77828a817e1a4fa0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938830, "uuid": "58fe312a-82c9-478e-973d-b9528c154bc2", "comment": "Malware payload", "value": "99dcefcc50652502ba943c08ddac369462e958e5e6fac385acc9ab1d254401c3b5865e6b53ffeeb6092e8469496dcdf6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938830, "uuid": "2498cc22-f79c-4047-a1a4-f331c0cf7591", "value": "T14F4155821C9666314139C777B26442DAFA5E33870F80FACD7A91C18D2F5D2938BDF985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938830, "uuid": "833bf56d-b816-4811-b8c8-a6808bcd7e93", "value": "48:1o/BfScAObEpEu+3tj0udzokhindjGGJvkCdJ1/pHhBaJr:1o/nEGXj2khidjGGJkC1pHhEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771938830, "uuid": "4682b4eb-7454-4808-bb55-f47cb90a04c9", "value": 2258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771938830, "uuid": "c8038450-b93c-40fc-80d8-5c1a5c79ff9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938830, "uuid": "7b80175f-dae9-4246-afd7-87a73598ddc7", "value": "PhF231.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2286b67-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917478, "uuid": "cae6b998-de86-4857-8ccc-ff3975758466", "comment": "Malware payload", "value": "b6bcaf0f12d78e7d10a57da2b9f58da8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917478, "uuid": "f2c9af39-3118-4d5c-b637-f7e59a0ef65b", "comment": "Malware payload", "value": "940a0ab6a49c96197819a41e85c52df887fb9c0f55724feb77ccf97a3c962639", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917478, "uuid": "3620d16a-5862-4914-b702-29559bcfb7f9", "comment": "Malware payload", "value": "56347c90d48369bbb2629e4e8a738ebedca209d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917478, "uuid": "49e26bac-3f9c-4e41-86c6-ad0993681331", "comment": "Malware payload", "value": "c28987e09f6d93f632b432e1b2ee295efeea739a4f2457b439f8dfbf9a365d19df9e645be6494e73f32d2450fbbfd599", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917478, "uuid": "c98b6c9d-3858-442f-bd14-057026723b95", "value": "T19DD3D84417CA41CC79FEFA2CCEA84A86022D9E5407580EF9F9BEB777F705716A508632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917478, "uuid": "766b4312-d230-4489-8b63-480d2adb0b4d", "value": "1536:CPXZ6uSEY/G0Xv/6RgIpvKseW3SJuh9uCwryTtRjSG9IxS2ZFEAYbHvAM7N6vOzL:CPXZ7YFnp94YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917478, "uuid": "652f8ab6-1ee2-477d-b782-f0441f3fed6c", "value": 137033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917478, "uuid": "f0ad258d-6d54-4105-871b-5f42bbced693", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917478, "uuid": "d2c93951-cdb5-45df-856f-ea57c7d8ff23", "value": "invoice-1645080830.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3d7311-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919563, "uuid": "94571377-032e-4e60-af6b-817c9d050737", "comment": "Malware payload", "value": "5309c7170dbbbad90fb892194fb95ef3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919563, "uuid": "8932758a-5ad7-431e-a129-392c46462259", "comment": "Malware payload", "value": "94e207868a8e31ddafec8a4a06eaa2bf9f3329568a776402ba7867252a96b3b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919563, "uuid": "d97e2212-cac9-4e9a-9805-acbfdbc92d2d", "comment": "Malware payload", "value": "683e4580112abc2ed335bf7239da5ad4e3b23ed3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919563, "uuid": "267af409-016a-42f8-8776-6addd5011b49", "comment": "Malware payload", "value": "4b83c4a8d3cd44fee5865a98fdc46cb62f5d8624613155808fdfc9610fddd7d4a5c91e23458095744825fe350a3cb5af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919563, "uuid": "9eab82c0-dccd-48a7-8c08-736b85d6c3e0", "value": "T14DD3B7C37B4F8F6361217741952FBF91DBED6AB2106C00C8A2025B36D2BC15B67AF592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919563, "uuid": "2dcae5ed-7273-4aac-8d78-3a1d3b8e0a78", "value": "768:C8m/Z6sZjWsYuSwnckNuRZEpBvjAF0BxeLScFYHXwz04mYF6F2r:CPXZ6uSEYip2Fm4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919563, "uuid": "280a854c-83d2-4162-a866-d59d56800f34", "value": 137973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919563, "uuid": "d3873334-7128-484b-8efc-a1bc42af8995", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919563, "uuid": "e2cd960c-1391-4087-a53c-e2716b9be5f6", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6b4c22-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928961, "uuid": "1cae46dd-32ff-46bc-aa60-383f58e26393", "comment": "Malware payload (Mirai)", "value": "1e77ccf57a512fb5142f6ab938b567f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928961, "uuid": "5c2edb41-0fef-4cbd-bfc5-9a88b4e346d2", "comment": "Malware payload (Mirai)", "value": "95008f5628cadb026b7a5af8a255741104144b580da651295b2b5a0da8719c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928961, "uuid": "1a94aafb-fbcf-4871-9b26-c6303a9d68a3", "comment": "Malware payload (Mirai)", "value": "ddcf74b5174b4d2dd12a317cfd1a50429cdd5280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928961, "uuid": "8dfb6646-bc89-4c04-aa76-72b8972c3391", "comment": "Malware payload (Mirai)", "value": "a9c6b39f123a8901d34c1fc27c8cab4b917ac48cc5d9bd2064671a7815d565a79c7434192e0e15c32f3fef41d4609d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928961, "uuid": "467f5fbd-0c1b-46a2-83e3-930eda670746", "value": "T148733985F987C6F2C4474830416BFB3FCB32D9A511A1DB0DDF5A9F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928961, "uuid": "4a94e3d1-286a-4702-b627-6572c01a562a", "value": "1536:Wt6dVFeGBV9ah2tYeQmP7uW2wORzBbkivom3aJeCdLNn:WtSjBnah2tYe3PrXORzBbVvHCdLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928961, "uuid": "a69e34f8-c0f5-49ba-8f39-4d3d880af199", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928961, "uuid": "8da6519c-319b-415c-853e-db8b408988fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928961, "uuid": "6fa82605-1bee-4f96-8d45-d29ee1092e79", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349cc01c-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897403, "uuid": "23af5c99-671a-49fe-9b37-1e05ec2fe9fa", "comment": "Malware payload (Mirai)", "value": "e8176a681d7c3398cf9b6b2f1c0a8fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897403, "uuid": "8565125b-f746-4b21-b147-23ff277a0aca", "comment": "Malware payload (Mirai)", "value": "952a85defa6822d7954038f8f3ec50f4f132a8ce5fe7856619e0330d6a7e42b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897403, "uuid": "f107aac5-b5a3-4ab0-8265-995bf9d404e7", "comment": "Malware payload (Mirai)", "value": "02a9ae46a1641711ccb6b745f85cc277c68682c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897403, "uuid": "55b64a1b-5602-426d-b601-a408fe31f15a", "comment": "Malware payload (Mirai)", "value": "968698890ce329ff516360411fdf691547759507b45ba140100571f74a0e439a16afa35738ff0ac970402046dd1f6ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897403, "uuid": "67377399-1ac9-4cf6-bf68-11c236247e2d", "value": "T11F8339C1FA8B80F6D447483000A7F73FDF32E6654161C62EEF699F36EE23542A516698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897403, "uuid": "80768168-2822-4a43-9021-acdb59ffee47", "value": "1536:T8pn30LqgaIftEV49kCShr8jQ1x2BLWQMR3EheVk4YgLc6eX/z8v:+n30LqgZfaV49kCShgjQ1o0pJEkk4JL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897403, "uuid": "bb5d6bf6-4faa-487d-b1d6-f15a8137e1ac", "value": 87440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897403, "uuid": "a46b63ce-1817-441d-ba56-68322612addd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897403, "uuid": "d3b5a659-57c4-4c05-aa2e-82fc666e52e6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ae0ba3-111f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896069, "uuid": "6ade8f27-1472-4247-8115-7fb248a7fbc2", "comment": "Malware payload (Mirai)", "value": "2c5adc5354a324a65538ca4432d9d577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896069, "uuid": "6b308134-6c76-4427-9d21-40eeae5b07e7", "comment": "Malware payload (Mirai)", "value": "96708ef718c649c9b480b176ae23f95624bb4d91d3894ff57653c44293e3c027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896069, "uuid": "0257bc56-6b03-4fb0-8b26-0e19c42ff1da", "comment": "Malware payload (Mirai)", "value": "dea806e1a67d2faf0b1b7af0ec6738417e7598b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896069, "uuid": "30c1c71f-0bcb-405b-b083-a5a46c2af2e2", "comment": "Malware payload (Mirai)", "value": "dff70a49bde741979c3cd46bc62e46c52a41dc064e3a9b05d4119ea30eb0eff013e566dfa5ba61c41a49a98e2906130a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896069, "uuid": "dfdc7eb0-0f27-42ce-8aed-8d41614e90b0", "value": "T1F0636DC2AA43D4F4EC1B05712177FB3646B3E17E1019EB4AC769E935FD12A41A22A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896069, "uuid": "64e28915-018e-4e4e-b24b-52d6317dd036", "value": "1536:URxPcFA5RHY634TDDDZ+xgy4lDzxheLB0e0m76Y:UH0is6ofPUH41xhIqeWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896069, "uuid": "daf62ccb-6cb5-4ff1-9911-4d8f37aeb65f", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896069, "uuid": "39e6c5df-7f66-4735-8586-7fe4c0011fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896069, "uuid": "b154089e-4dac-40f1-839b-d51952df37db", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bce9ed-118b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771942577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942577, "uuid": "ef3e62cf-cea6-4726-871f-1a0762c1f383", "comment": "Malware payload (Mirai)", "value": "c35bbc41168c85790b271e02c0bd8a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942577, "uuid": "8423afd9-393d-465d-ad2b-455107d2f0b4", "comment": "Malware payload (Mirai)", "value": "974cd07a7bb870325b90d27ba3b03f9bbfec1eca436002b8a85b4f3980bc6611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942577, "uuid": "854f4f1f-e5c6-4c20-9881-456d0325dd3d", "comment": "Malware payload (Mirai)", "value": "f0fdda5a68799162f84b61e7859de11ab36d477b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942577, "uuid": "090ce085-e3c6-4082-9a36-ea7bbd53e4c7", "comment": "Malware payload (Mirai)", "value": "1cb8dd4f27de1aadd0ac9d9635d99d76fec1c018a84546111c524edd1d9dca58aef72f0bde64c31f96c8a2d18c38ac05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942577, "uuid": "27758169-ccbc-41f3-bf24-0e5943170f5b", "value": "T10DE32756FD819B05D5D126BAFB5E928A33231BBCE3EE7112DD205B2123CA55F0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942577, "uuid": "a90bdf7e-0748-44b0-81de-1987cdc6d579", "value": "3072:hldCPZuDN90pOo7R2sZraK6nktbfV9GGT8EZNudOtPb2KqQA:hUQ9IOoN2uraKKktbfV9T8EqdePb2KHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942577, "uuid": "98a173ca-fe79-49e0-89e8-de3ae4af97cf", "value": 149340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942577, "uuid": "c93a5434-745f-4f5b-8ecb-ebf53bf2472d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942577, "uuid": "d15680dd-9215-439b-925a-16c56dd5dac7", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd91cc1a-117e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771937173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937173, "uuid": "f35ceaae-8263-4f11-add3-8b872b1422ca", "comment": "Malware payload (AsyncRAT)", "value": "331fb514a8676d7ef8578fb0d1a422e1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937173, "uuid": "61c471ad-df8a-401a-b488-8fa243e9c98c", "comment": "Malware payload (AsyncRAT)", "value": "97df07e99e9c1efa406ece2cafb807d94851b65dc5960f9065a1baa86a5ed403", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937173, "uuid": "fd24e53c-3a76-4e0a-b976-f9eb289d0e91", "comment": "Malware payload (AsyncRAT)", "value": "f401766ec7254f13c9f1843c06438fd5be975b68", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937173, "uuid": "a41799a9-98e9-4cdb-af38-80bdef936cb6", "comment": "Malware payload (AsyncRAT)", "value": "d62c33c2ae107fad5cd69e11b7fcd1f47282348cd754838645159a25f9fa4aa49ed911dd62502e0100bebe39aa666117", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937173, "uuid": "2349b4d0-e80d-4e74-bda2-dcf491346f16", "value": "T10C41DAB2FDC81D6A4FA8F0A413B7959502BBA9C424213EFD10ED1DC44E90167AD7A86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937173, "uuid": "f4ec0d9a-4217-49f9-8014-15fff1483776", "value": "48:FL1P3+SYW4XZMzPGdhcuHJpOPT8dEiu80vRG5az74e8VSo+iu824ooqj:jPbYUkhcuppUWpu88gazEe8VS2u8rIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937173, "uuid": "a153f4b1-ba91-4939-a2f7-ba49de59b338", "value": 2319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937173, "uuid": "dc66ae96-4b4d-4563-9749-62d9fc23c82f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937173, "uuid": "ec8e7c9d-ecab-48b5-ba5a-2e06d8fd8091", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5896fbd-1127-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771899847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771899847, "uuid": "927952ff-4efe-4338-a3bc-104623a6ff18", "comment": "Malware payload (Mirai)", "value": "a42da0413aae6e480069c9ccd53b43dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771899847, "uuid": "166cca02-6050-45ab-964d-231cb86569bd", "comment": "Malware payload (Mirai)", "value": "9841c75cc1905e565c6c8aa1715fd8f8324bdbceb76eec5f6d708664aa5562b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771899847, "uuid": "8597724b-2efd-4166-b375-e6c6bfdeb654", "comment": "Malware payload (Mirai)", "value": "cb11d45761df17cd417ef3621511bae89b22f8dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771899847, "uuid": "2734d6a9-937e-44dc-8779-ae73dad366e6", "comment": "Malware payload (Mirai)", "value": "b79e22856732b8e4b5b0f07d070cedaeeb6385c4deb33e17f368888a03ad410f2fd58bccc452cfcbdc45719cafdfe376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771899847, "uuid": "6ccc588e-db90-4a14-90b1-ee4aea64a6f6", "value": "T18EA3C94E6E318FADF768863047B34F25A39823D636E1D685E26CD9041F7034E646FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771899847, "uuid": "12d24789-9f9d-45e8-a913-95b5204305c7", "value": "1536:btM1D9VDrDQgzyrnZ3g6gs6oOVpamU5zcOeI7wUzsSX:QvD3j4nZ3Q7paX5zctysSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771899847, "uuid": "00057a75-cb29-41d2-bd5f-f454151c6202", "value": 101716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771899847, "uuid": "a153c39e-80ae-425b-b0cb-fc4abf689050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771899847, "uuid": "76108130-999c-4f80-b969-0d1f7062c102", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dc7df8-11d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771974095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974095, "uuid": "c9efc8ba-8cf6-4a24-a0ce-1c3bbddaca5b", "comment": "Malware payload (Mirai)", "value": "22891c0056e2f24ab0a758039ac6b837", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974095, "uuid": "671e1275-3842-43f3-a872-cc87443cd761", "comment": "Malware payload (Mirai)", "value": "9867e348902a09fc9ff6df4850133a3114f6164271c773fc77ecec7703cc38ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974095, "uuid": "108e6b44-af01-4b14-805b-ccbb01986e16", "comment": "Malware payload (Mirai)", "value": "1ebc8ed7ad1459e0528b68207e5c6880feba1925", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974095, "uuid": "d744bd7d-5754-45b0-8f9f-9c3fe468bc03", "comment": "Malware payload (Mirai)", "value": "46f2296e1c81a0f5ffba0facb35d8a5c8738fae6f894e5e31d9e03d97fcbb83c524d9d10fc77d2ede7e0bbf7bed58d24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974095, "uuid": "64d35725-b928-49d2-b509-e1393026cfb7", "value": "T18A937D85FB83E0F0D94505B011ABF7798A31DD362024DD7BEB98FE72AD32612A11675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974095, "uuid": "4b3a6951-f8ba-42f9-92d1-da1966b2776e", "value": "1536:NiZdINh5h3V2j6nz2J0NLwLrZFj8GGG/qo/8waUd31QgHLrdi76rz:NCuNh5h34+z2J0NLwLrZFYKtumEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771974095, "uuid": "3482331a-eff6-4865-9848-d86493bef831", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771974095, "uuid": "e03e5482-dfe2-4302-9850-80a56968e332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974095, "uuid": "ab261fd3-f6bd-40ab-baf0-3248068e604b", "value": "ez_nigger.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be22363-1194-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771946485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946485, "uuid": "94d342b4-9c8c-4cbd-8bda-dd81b0b97ec6", "comment": "Malware payload (XWorm)", "value": "62b1a724313e89ebe1d9ac66f0d65001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946485, "uuid": "8d587253-345a-47b9-ab79-4a2b194dd119", "comment": "Malware payload (XWorm)", "value": "99b2af9337671b33edc29fa48a367dfc89b2b4381cc297062c25a314d09638a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946485, "uuid": "19a1669b-3541-49da-83bf-765392d6682a", "comment": "Malware payload (XWorm)", "value": "e7ad0317e7b0bbbd5f5fa6edfde46777c78c1e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946485, "uuid": "8a770822-55b6-4e68-a134-468b081afca6", "comment": "Malware payload (XWorm)", "value": "57d38853ffb5896774aaaeb64224468c09176ef66137ffb302fbeafed38e4ebbf0c49fc94231701a69c553b9e3f5c642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946485, "uuid": "1e0a71ec-4223-4736-95bc-8c828337296d", "value": "T1CFF307CEBF818D55C5180BB38053118A46BEFC96A027EB9723C578F05EBBC9B4E57891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946485, "uuid": "06a8f886-f585-4214-ab23-558357b65b66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946485, "uuid": "92967b5e-e347-4db6-8f53-62fe110699db", "value": "3072:IEKoBXvjA3oF0b8zSjCq8MCmdcQteEcbmcFa+r:IETBXLA3oOC9b6/Vcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771946485, "uuid": "beeaf9a7-8a38-4174-935f-3e2612ae9e1d", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771946485, "uuid": "39c82bfd-191b-4d8f-aba9-3d242c81cb22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946485, "uuid": "697cde45-096c-48b8-869c-09839e13d4db", "value": "DiscordClient64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7719f6-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "34201158-5e3d-4a29-b4ab-13628fbeac29", "comment": "Malware payload", "value": "be9ed9af0d622c138f75bd6c6cbfbb47", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "microservice-gl", "colour": "#B8E966", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "9bc7daea-6d95-4722-ae9f-e31f9993f347", "comment": "Malware payload", "value": "99c14fe575945dedb459fd37218e9c64f4847a06436491145622682968d2e2e5", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "microservice-gl", "colour": "#B8E966", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "16983ee7-a636-40f2-82a8-d4617a3f8708", "comment": "Malware payload", "value": "59ec59774b0b99d2e2b758dd5cf69f80811daac8", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "microservice-gl", "colour": "#B8E966", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960577, "uuid": "55d67334-b0d8-4ec6-a156-e993957476a2", "comment": "Malware payload", "value": "747d8aa3b4830873c76a6b38d225688b0095ebcdea530aeb88e1ad57ff8aeb6b37741da3bbbc163cd58b6de44f2a61d4", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "microservice-gl", "colour": "#B8E966", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "ce5f5ac5-d5a4-4c08-999b-6492eed9b8a3", "value": "T1B9B501012636A36BC195EABDC0D7927EFA35A581231DDADB91C01EF44EDC780ACD6336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "9ec8c168-e865-4c92-9956-692bc794be7d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "f101458c-b057-4b2a-ae13-ba9936ccb839", "value": "49152:39JxjMtr5vYt4dnZljrlCzpyEFPd9P3dkdTgCbi/xL:NJxjMRlC4VN+nHmcC+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960577, "uuid": "f5ca33ed-6444-4f97-b5e4-e2d0fbc2b745", "value": 2464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960577, "uuid": "3c33a335-83b6-4810-9dad-1216426c536f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960577, "uuid": "ee2c82ad-02ec-4973-93f0-655627f18e3d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcd8880-1157-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1771920235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920235, "uuid": "57e54329-6605-4d13-b864-013d7694ade4", "comment": "Malware payload (NetSupport)", "value": "8d8acd1a0408d1c4f113295cfd591a1a", "object_relation": "md5", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920235, "uuid": "db0ff730-8913-4ad6-9140-824be63e8ddd", "comment": "Malware payload (NetSupport)", "value": "99dc774c56bfda9155ab76441a5a16c47acbeb78530d5e8998a875173184bf3c", "object_relation": "sha256", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920235, "uuid": "a0b12fd5-b474-4ab6-b64f-b44d7082d39f", "comment": "Malware payload (NetSupport)", "value": "6563c70862fc2f81b96b7c041352d475d235a28b", "object_relation": "sha1", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920235, "uuid": "b5e65e62-fb41-4ee9-8314-2c160aa9d746", "comment": "Malware payload (NetSupport)", "value": "0a99d62497983a40cb7b8c3d88647aa81498acc09ee210044967244ada2c9ebbd0f5eee31aa5a34f5a1e3b8da754d6ce", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920235, "uuid": "5cba6af1-2c7e-4c7a-ac78-2a12a9805f25", "value": "T122A2D130AB7CE266FB5D4AF3B3D6794C8FE850185680428AE8CCFD460B4FBDB1156169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920235, "uuid": "d699fc6b-34f1-44b1-8d21-45f49eadf303", "value": "384:eXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5Nh:eXKuqXS69Szi/urdMt5lBUeuhJrsRxLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920235, "uuid": "19cf9138-81f8-499f-a9ce-1ce6969275b6", "value": 22010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920235, "uuid": "e59a0b0f-1792-4495-832d-b82fa96b0dab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920235, "uuid": "656ace45-2e3c-45ea-a567-f88cfaaa6ac2", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a25e738-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952522, "uuid": "160ed4fb-e61d-4423-9462-dc08af05d494", "comment": "Malware payload (njrat)", "value": "6b2375203836af188b512895710d6834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952522, "uuid": "7816b781-592d-42e6-b237-be071b9cdaf1", "comment": "Malware payload (njrat)", "value": "9aa314ac0b10b159cb79729a2fe40d4b87997beed3a670252669bfd1615e20d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952522, "uuid": "9f8cc45b-a428-4a91-a099-7de1df9d6f94", "comment": "Malware payload (njrat)", "value": "01223538e053bdf53611325763320cc2922228b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952522, "uuid": "0561f6f4-5e19-452b-a80c-7e06c89ec4a6", "comment": "Malware payload (njrat)", "value": "12ce916eea2278f8837df980fa49331505cd6d4114c5f8585819d140facf4d9bcd15f559304bf5395077635a051a970a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952522, "uuid": "bc8954b4-318c-44c0-8541-e327c723b2c3", "value": "T17B032A4D7FE18168C4FD097B06B2D012077AE04B6E23D91ECEF6649A37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952522, "uuid": "a0c9d946-1a85-4789-a1fc-16b6b9626b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952522, "uuid": "4954034a-321d-49b8-ba1f-25eb8563c18c", "value": "384:mT8CT0i9FdTe/kCOyU7lGfz+DfEWjrAF+rMRTyN/0L+EcoinblneHQM3epzXONrs:ihr1CFU7lG67EwrM+rMRa8Nu4Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952522, "uuid": "65c02cd1-d69d-48b2-a01d-b9ee231e5ac4", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952522, "uuid": "b4cc283f-8161-4e77-bebc-0e6c6a43763d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952522, "uuid": "bc9a3147-2b87-44b1-a136-4a08dc6368f1", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cfc0fe-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917484, "uuid": "ff7e5b6e-a07a-4fa4-8f51-cb352047dd16", "comment": "Malware payload", "value": "95b9fef7d48f9ebc7e32bd4bce128b6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917484, "uuid": "3471236b-2d40-4d00-be9b-bef43144da34", "comment": "Malware payload", "value": "9c31e11c68bdb15154446805ca47cc9f12ccdf5bb5365ca5c3067548fac23417", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917484, "uuid": "562fe18d-23cb-496f-b83f-5b81a848f04b", "comment": "Malware payload", "value": "dc96a58698a06d6f39a7a3ce9bfc85673e0e1343", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917484, "uuid": "fabcb458-fba2-4840-abb7-76defc09887d", "comment": "Malware payload", "value": "1a2db18e460cebb7462f5527a819af80b56d2256952fa51dbe6603979d118718af304d456ed5f148caa8e9cefa3b92dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917484, "uuid": "57d1502a-a828-4c96-980b-3af63853410e", "value": "T1A7D3C7EC9D12600E98B9EF774197708FF98C9818C08321B491F396A17B3EE5395B6F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917484, "uuid": "0a8d0c77-dcbb-4bf6-9810-d96a1a5961f9", "value": "768:C8m/Z6sZjWsYuSwnckNuRyu5FuKJtfp6exeLScFYHXwz04mYF6F2r:CPXZ6uSEYlFJpb4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917484, "uuid": "dddbe927-267e-4f41-bacc-0bbe3a6e4a70", "value": 138944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917484, "uuid": "7b7b0678-9ecf-4e1f-9ec4-fd226281ef54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917484, "uuid": "50436e70-693f-49b0-813a-f6f6dacf5ca4", "value": "invoice-1645080830.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e333522-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919323, "uuid": "345f389b-9794-48c4-97b9-d3676aa9d9e2", "comment": "Malware payload", "value": "44278bc51fae70a888ccd6cceb7d1d6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919323, "uuid": "1457891e-7f91-4e74-9688-dd9a33dd80a9", "comment": "Malware payload", "value": "9c36300b9a28b4bef046fa9c91770010184628e43b05c980b7325584ecbf01ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919323, "uuid": "3ac76e24-ab8a-4273-a6cb-431bb8dd0c0b", "comment": "Malware payload", "value": "03ddb01a29ade58be62e5d3d38363c65b1b91e6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919323, "uuid": "13361ff8-e2f1-408a-b16d-3bc21c1452e5", "comment": "Malware payload", "value": "b6bbbba13693b849d0a2ac2891cbe8a15bd23fbc506aaac8d4a323b31d1b3de7ab742413b1057ad79897dde9fada8471", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919323, "uuid": "4a72d43f-a430-492a-87d1-18abc6624b04", "value": "T146D30A47788714B9E35E2BE1802B391C5E1EF632DBCDD481286A26F6B0B4D48BD794E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919323, "uuid": "6ff59121-b67c-4a8f-9a79-093d2ff425d1", "value": "768:C8m/Z6sZjWsYuSwnckNuRfMFZpHpiAuUwWHJ3D3iFuFxeLScFYHXwz04mYF6F2r:CPXZ6uSEYfMFZpt4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919323, "uuid": "748ef3d0-fb2e-46c2-b7dd-1a0253c6e3c5", "value": 138947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919323, "uuid": "d5956a13-43ac-4185-9b38-f3d04a0e6baa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919323, "uuid": "2c1c3245-9d0b-40d4-b10f-8d0e33162027", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784636b8-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1771952492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952492, "uuid": "9a807053-b5af-4c15-bb43-9ee4d88f5e86", "comment": "Malware payload (DarkVisionRAT)", "value": "1e1e94f311ad1d4db2132ea742fdd704", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952492, "uuid": "19af5abc-acbe-406b-aa8d-2a5cf00c7b75", "comment": "Malware payload (DarkVisionRAT)", "value": "9f29563ca323046c2ff4f7ee64c298221dd03a4cd54fc1b56c875b293cfe03d6", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952492, "uuid": "89f2a4cc-d898-4f2a-a071-866fcbafd491", "comment": "Malware payload (DarkVisionRAT)", "value": "768cf9918b7354ca26dd159d73601a914c8caf76", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952492, "uuid": "2d471af8-d4be-4b15-b804-4b38052a7863", "comment": "Malware payload (DarkVisionRAT)", "value": "82cfe015d0bd07b61c5b5c153df66c30b8cca64894a1e57c1b8b1530c0171b06fcd146b3c0b9d0f310d038256cc94f21", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952492, "uuid": "11466721-6ff2-473b-8af1-cf5225e2cf1c", "value": "T10C16D7E320C2A6DDC516C57B8713FD7F988F713A472A94E3A198E2129D26CC43A75F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952492, "uuid": "a16c085e-8c60-4b8b-bd28-83be0c25794a", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952492, "uuid": "54e45ef5-0116-4c06-8ecd-7e714c93ef3c", "value": "49152:gEKBtPNnWAQ9iojaqnjrkAU3GEbsslS7WXxNJodU5eB6:meVr+WEaWNJoi5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952492, "uuid": "7daf910c-4de9-405e-96c7-c9f76dd0dd84", "value": 4307968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952492, "uuid": "f104bf96-d519-4ed9-955d-4bef42e19b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952492, "uuid": "06bfefcf-4ff3-4f30-bed5-631c9693b020", "value": "Confirmacion de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1152fdf-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917342, "uuid": "8d9140ef-e199-4be7-a117-06760d1442c2", "comment": "Malware payload", "value": "12350bce75d3a198a1b830263e7ad6f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917342, "uuid": "a555850a-a9f4-4482-a892-2e33f223fda8", "comment": "Malware payload", "value": "9f353f3bce48a0788a5e0443cacd97e9799c6482c73f007ccb4703a7a5e787e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917342, "uuid": "816e3f4f-a169-4622-8844-409373fcb498", "comment": "Malware payload", "value": "d013f47ab67e016d8ce0177592460684a46b861b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917342, "uuid": "dfe2a5b9-d724-4338-b7ae-aa31938d7f65", "comment": "Malware payload", "value": "bf1dc61e565595f9ededc3e5ad9256452ad925405a97abff423eb1dd46519f11a50e0744a0967ae702951c7371be98f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917342, "uuid": "d84109f9-553e-4523-883d-551b7b586285", "value": "T186D3EB006E96DF921C5B905BF86B883B7BBB2C10355173EE25341544EFB5E72E4AA338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917342, "uuid": "f5db093e-5c46-4d45-acbe-9159528bb084", "value": "3072:CPXZ7YCUmNtcITgEVVb/d+wJDcHxKZxViprBwm272wp+qtUii+at6L0IvekpwswA:EXUmNtcITgEVVb/d+wJDcHxKZxViprB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917342, "uuid": "4b76c22b-f21e-47a5-9252-a88d6284dfaf", "value": 139921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917342, "uuid": "b906a803-6530-4172-85d2-0ba48a06f4a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917342, "uuid": "c67af0f7-5223-4384-bc34-f3539b3130f3", "value": "invoice-1645080830.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4b4ae0-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897340, "uuid": "2d643cdf-583a-42d4-9bd1-8faaa6b6177f", "comment": "Malware payload (Mirai)", "value": "1ff10e96c78002eb0b92697edb647b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897340, "uuid": "1f1e1598-cc7b-43ae-aae2-6c1ff57df6f7", "comment": "Malware payload (Mirai)", "value": "9f3c1d176f3cc78bf678552ff62ede0f2249f00e97e3912752458c08bb07bb26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897340, "uuid": "24fad06d-719f-43cd-9e77-10a4642b373f", "comment": "Malware payload (Mirai)", "value": "37641089b4539154aa9abab34e20397d35d949de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897340, "uuid": "0bdd76fa-de40-4ba6-83ee-025d1736a1f7", "comment": "Malware payload (Mirai)", "value": "cfb402c207d9c5028b22a22640a99940724b50bf83238e03044bfa3f43a934c79d5c14aa76ec1cd760b8876313e9e080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897340, "uuid": "78d410f6-1eb2-408b-8698-1c25de1eab0e", "value": "T1C6737D99FB57D0F0D94205B011ABFB3A9631DD361014DE6BEB88FE36BC3264294563AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897340, "uuid": "f07d1484-f087-4fd0-a962-3b417c1d65f0", "value": "1536:Lp9vxnA7U15vbIHfC1j83YAKoRYeyUz31Ai6I2r:LplxA7U/8HfC1YJbKO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897340, "uuid": "fd310c2e-2245-4fdc-9b43-d2885bbebf0e", "value": 78900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897340, "uuid": "a355abd2-3f4d-4ab3-8a02-ca30b3e1eca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897340, "uuid": "994faee0-622d-486f-a0c6-887d15e03b08", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ef97d5-1190-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771944964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944964, "uuid": "ae186597-9324-4adc-83c4-e0f86998c56e", "comment": "Malware payload", "value": "9ba2db757893d214285b06edee9e4388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944964, "uuid": "8f07c18f-6a1a-4764-9438-1a9c8a7fbcdb", "comment": "Malware payload", "value": "9f60f244e5c10d02100884aa438b2d44ef7d81b4dc34e41df092af464f831bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944964, "uuid": "12738376-cee3-4cff-9886-ef3da2411c8e", "comment": "Malware payload", "value": "c6e4810a03f1cc956d977f47b3d337c36b430a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771944964, "uuid": "b9dd9e2d-5849-40bc-ab64-8473ad0d739f", "comment": "Malware payload", "value": "d8f9d37d2ca6be88d6199102a9ea48498a1de968ec3848f0f44c9ab9edea4fbea69dd958c32efc94df688e894a3e86de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944964, "uuid": "3dfc67a6-8d96-4531-9544-b81445b8e0db", "value": "T1A2D49EA7F3678E21D1845777C1CB9A4093B49685B5A3F30FB18413E619423EEDE0B6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944964, "uuid": "396df63e-a2e7-4371-a98a-c8c59b0dec36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944964, "uuid": "5d1e5451-646f-429a-9e6d-e83c995018fd", "value": "6144:lPT5yVUN3PNkdKkNeLXmbO5gKxWl2tU8TppiYopfORhyGoYQpr565OChx8LMJZWP:ldySH4bsRDwYU8rgJ1dTL+RYs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771944964, "uuid": "d1947bc9-5dac-4880-8294-3269f55b901e", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771944964, "uuid": "ccd8264f-2963-4884-8b94-ad55e2e91a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771944964, "uuid": "c5bb0b9c-2fc5-4e2f-88a1-769f3a1406f5", "value": "Lhonpr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97077817-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928921, "uuid": "478c0c89-b156-464c-a579-e94abd5f2357", "comment": "Malware payload (Mirai)", "value": "55dc8edc21764b7a6bb8d037d911eb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928921, "uuid": "864ab2bd-69b5-4f21-8488-d397b9b68744", "comment": "Malware payload (Mirai)", "value": "a054d47438646000621ed894a537697cc3a223e0e09037186af29058619a031c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928921, "uuid": "17827f38-4897-4508-be93-95c8a30eae8c", "comment": "Malware payload (Mirai)", "value": "973e487b4978b825d545c9c58c48f4b5b021e6c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928921, "uuid": "e99e7f93-0979-4369-8e30-593d14de66be", "comment": "Malware payload (Mirai)", "value": "b23da85cfa634adb4f2c4bd9ca96128d934addde3d1efdbce5d0dd506a3f66eac4a4d8a89f070627c5a80e72e2348b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928921, "uuid": "41218fe8-ff23-4cc6-ba04-e504f9bd9166", "value": "T163735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928921, "uuid": "5caa2649-c8d2-48c6-8d5a-96135193c926", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fVD6t:IfmhxCMRkg7IF+7SDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928921, "uuid": "99742320-a379-4288-8c68-8e57eb2f8a12", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928921, "uuid": "df28fef1-c941-4a4f-949d-cd789ddb7b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928921, "uuid": "f560ba36-8cdd-4e92-80ad-715f19b35838", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2616a752-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771916706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916706, "uuid": "31307aa9-ab75-47dc-a9d4-adbd2791f024", "comment": "Malware payload (XWorm)", "value": "6667dfe2ff34d6e78a7ec44167fdb96d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916706, "uuid": "f69a263d-959a-4d93-83ce-fdae3beeb96d", "comment": "Malware payload (XWorm)", "value": "a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916706, "uuid": "9e328af7-0cb5-4ca1-be80-66d1f2093b0d", "comment": "Malware payload (XWorm)", "value": "af3190712536a11f7fa8bdd2ec4615e13e95a762", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916706, "uuid": "145c497b-fb22-4ac2-a452-0a787854568a", "comment": "Malware payload (XWorm)", "value": "c2071a8aa2bf316038dc6620cc2b58ec5ad483b04d0eabe70a979e9ad593f2275698265df35e2bdb94bb271f94488ded", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916706, "uuid": "accab347-4594-4f68-89c8-31dbebae2ae1", "value": "T13552D0D6E900AA72E07B922C3B3073CBE696CB7C6E9DAA533B148D8485F324555D1153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916706, "uuid": "93871ea3-75c6-4089-ae43-0414599ca307", "value": "384:POlL5bDllo7y4SDWagzbm5l4F01amFjKyGHh:2lL5bQ7thbmYFWamFdGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916706, "uuid": "7b7df6b1-980e-46a7-ad94-18027c150c4f", "value": 14292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916706, "uuid": "155ce8a2-3629-412e-897b-54873f79a167", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916706, "uuid": "d49eb979-4ee4-4c29-99af-4388144207e3", "value": "P0-678766887678.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccfd012-11ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771957815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957815, "uuid": "9fd5cc60-30f5-4a47-9a59-98c6b6f62b86", "comment": "Malware payload (Formbook)", "value": "aa256e0b6f015b50ce26db0480a524ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957815, "uuid": "79def08c-19da-420c-aecb-26a49afcb997", "comment": "Malware payload (Formbook)", "value": "a14acd4e0522aaea6875e564a36e2713d240d34b748fbde157c5b38df906788d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957815, "uuid": "e1550e20-f90e-459f-b876-67dcb1cc736e", "comment": "Malware payload (Formbook)", "value": "202495f6f3920602baaeed075791acf9276b0fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957815, "uuid": "139b2912-c77b-42f5-851f-5e91425331c0", "comment": "Malware payload (Formbook)", "value": "e40b43654519437f45f8b2447747fe0f4f96c301fd800025589579c8f0c13ee00754cac7e236b9753cb4638c3853bfd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957815, "uuid": "abda5919-1bdb-4162-b95f-efad890ee9cb", "value": "T16E55CF027391D062FFAB92334B5AF6115BBC79260123AA1F13981DBDBD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957815, "uuid": "1c325744-1bdb-489f-9039-e3cc9bfc6226", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957815, "uuid": "34f0470d-8500-4ca6-a14b-3897b1309c24", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFEgRQjT2fUUnES/k:hPVt/LZeJbInQRaFuINES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957815, "uuid": "6643e5e5-4ea6-401a-928e-d5a017c82803", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957815, "uuid": "a44fef06-162c-4308-88b3-adaf2409e811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957815, "uuid": "9e72b264-1bb5-4768-beb5-92ad67200344", "value": "z35TNTAWBTRACKINGDETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcaf8ebc-1124-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771898598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898598, "uuid": "d2c473fe-168f-4c5d-a55f-e280e24a4406", "comment": "Malware payload (Mirai)", "value": "318893281288c8937dbf8e49bdc98d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898598, "uuid": "2e4bb2f3-6814-42c6-9f90-4c7d545d494f", "comment": "Malware payload (Mirai)", "value": "a24141b4b1836ca165549688a1b1b8a478ccce163ff737d0981535ce3379ba32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898598, "uuid": "6ab92415-68b8-46c9-ae03-0cafdcd17f1a", "comment": "Malware payload (Mirai)", "value": "adbd17eda7ab1b976f303360be4d67057658b513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898598, "uuid": "23926058-03c3-4a32-a022-ed5b5103c7a7", "comment": "Malware payload (Mirai)", "value": "03bf7fe1b7614d1ae66be552fdf9503e1a4b7aa7bda2e8d6488cd40d9cf6b7cd7e991bf927f81f4b7dbf7819395e1aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898598, "uuid": "0f534631-5724-4d9d-9461-a156348adf0c", "value": "T14CA33ADAF400DEBEF80FD77B44570A19B971A3D206830F27635BB963BD321951862E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898598, "uuid": "65c790f4-6b3f-484a-9886-d1a237e7ceb2", "value": "3072:BUKnxMWAl0807jZ54ytE/YLMngYS9KwOsd2/OM:9MWbQytgYLMngZ9Bd2/OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771898598, "uuid": "89aab6f8-52f0-4c11-9433-c2e9000ef57a", "value": 101736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771898598, "uuid": "880bcadd-6033-48d8-8d3e-8e482cce54cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898598, "uuid": "90ce2358-26de-4a67-b9d7-bf379da9a188", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc56037-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903861, "uuid": "ee5d4c3e-6e3a-429d-aa60-6c459fc2bf96", "comment": "Malware payload (SalatStealer)", "value": "b65243dac3b6b95adec705ba1cb7b7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903861, "uuid": "23dd3d17-0cf5-4874-8263-ed0f5e582af2", "comment": "Malware payload (SalatStealer)", "value": "a25ddafa1066b9b7d0c07842474e7a21e5b977be3313572636d4c1681dbc4ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903861, "uuid": "0a6a5a3b-b592-45e9-81ae-537518ae70d8", "comment": "Malware payload (SalatStealer)", "value": "42601b05aad8cfd7f65f21864a05ceb5f510127c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903861, "uuid": "a3341566-3d61-4a5e-8628-60edd5aab7c6", "comment": "Malware payload (SalatStealer)", "value": "e57d60c5e31886cfc196be41fdef8213426186ecb900944804f42a7358ad5f568497ec0aa4230f526ace8f75547f32ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903861, "uuid": "3479fabb-394e-447b-8582-bcc64d51bb41", "value": "T12006234DF98359FAD87F2570089FB37E8636A9050002DE7BCBDD5D25EA3B3201D2964A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903861, "uuid": "57109fb6-98be-4482-b099-4f48a9ef4dde", "value": "fc648d00fda0b8c1f218b9e9e89292fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903861, "uuid": "20b43638-edf6-4af6-a59a-35968ee042bd", "value": "98304:KHoCzD4/s9rSTIO06MCTaoi+5nSwPbwQ5XGu2LLq0UX:KICo/s9rGx0RCTEo9H2uYLqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903861, "uuid": "df8295bf-24f4-4eac-be95-c13cc66a989a", "value": 3862768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903861, "uuid": "3ad1db55-7af8-4ea4-a322-21e6327fadf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903861, "uuid": "72fadce9-c4b4-4ca6-8b95-3ee8d32b84ed", "value": "utw38u3qf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71e4e91-1192-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771945779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945779, "uuid": "a397d151-7203-4343-84a2-6f0e2e11ebf0", "comment": "Malware payload", "value": "cc8344c7509ebd1722f370e535c4bd3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945779, "uuid": "ceb59699-12c9-4781-a36f-d32c28aecdfb", "comment": "Malware payload", "value": "a26f79bd996c547b1ed86d33feaadc023f21e24df6a278ab2a054af570b206bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945779, "uuid": "4a628174-8120-4408-8380-6942e8e58d14", "comment": "Malware payload", "value": "4cf4b3cc7f63b0a12ac86a727e591dd51118fe75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771945779, "uuid": "8a18debc-a8da-4cd1-80dc-41e725f1d322", "comment": "Malware payload", "value": "9edff9aaa1a7f6b076a5df2cbfaebb652cfc69ff80bde2a746989306f7039a7124cad74467807ef57a9ad23318a26f70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945779, "uuid": "ca705e7a-d5c0-47a3-8423-af1bfd030297", "value": "T19B35EDA8D4EA85F8108B12017D069BF1AF34594BE491957BF6FFB2DBC86003597893F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945779, "uuid": "a6bd7fa7-d4f7-4b2b-89f5-a7e6d1aeaca4", "value": "1536:+PJpztO0b1x8OABtYMSdEUeFWwM6zoJN+5TNCdS9O/Qta:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771945779, "uuid": "59509811-5928-498b-bade-df8562235cab", "value": 1150445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771945779, "uuid": "fc58f30b-6555-4d34-952d-3b26fde742c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771945779, "uuid": "7cadddb3-6747-4578-9236-b64a195023ab", "value": "Enquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855f8087-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919443, "uuid": "44aae0fb-72d6-47c6-a837-3ef48ed3e81e", "comment": "Malware payload", "value": "665d2d3a44ccdfdc4a19219db873f09b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919443, "uuid": "68209820-8756-4e27-a134-d7a17920df56", "comment": "Malware payload", "value": "a2b6bc6c5e6d4aa151807f551e29b7b21dea76c50f15311c12cf9654bb17e44c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919443, "uuid": "5105ee9b-e224-4906-99d2-da2bea10dfe6", "comment": "Malware payload", "value": "d415ed84fede2b5f9222b87e240e726c85737d38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919443, "uuid": "dcc0ee57-aea8-481c-8c78-b7a4de3f06f4", "comment": "Malware payload", "value": "410bbd5321de5b0b8a985121b34c57516af755a911586b412964171751b0f591994a69eac5ac5a5653561835256ea13d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919443, "uuid": "7005bafa-8692-424b-b0dc-e95e85f015c9", "value": "T1A2D3FBD662A735DDF4ADFA29DAE9BC0606030D41EF731DE18AE9D5503338138362BE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919443, "uuid": "888287b5-1959-42d5-b80a-0f6d45ddac8e", "value": "3072:CPXZ7YJGEdU5SstehGUCQPx+bxQb1Q8Ioh+uJtUJnbuUEPpKy8+UU5kAG2UNIey8:EQGEdU5SstehGUCQPx+bxQb1Q8Ioh+uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919443, "uuid": "c9edf87a-6e73-4d22-8614-c2511cf456fd", "value": 139892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919443, "uuid": "5c56638c-7009-487e-934f-6a00fe146ea0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919443, "uuid": "6d1deb9d-71e6-4517-812a-a81be461f801", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379afcb7-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919312, "uuid": "52a34929-52a0-4b33-a886-91d9e78a4934", "comment": "Malware payload", "value": "122342884d31f856bfeff52582c450bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919312, "uuid": "ef90526b-0ab6-4bb5-b804-19903b0e85ad", "comment": "Malware payload", "value": "a2d90ac37ffffcdbe0b2db56515b7fac38aca36b88b890416b352e77d1bd6184", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919312, "uuid": "d195d4eb-dcd3-46aa-848b-22b8cda91469", "comment": "Malware payload", "value": "0871dc921f7c651f5f6d45749e2dbb829bed095c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919312, "uuid": "51d28c00-f9dc-4a91-bda9-77a39f06286d", "comment": "Malware payload", "value": "20aecb8ea6284aca252710757f7cce9cbe1ba46dc9e9e76b8d92dfd5ce9f2588b754ce660e094b826d1a566cbd12c9a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919312, "uuid": "bbb1240e-de2c-4e3b-8a97-3a7bd1d0583e", "value": "T1E2D3E91CCCA6BC8E81FC01BD7ED8925082C626DDF75BC9E3DA195C3065BA84CB75942B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919312, "uuid": "c46dd146-493f-4048-aa8f-532fa077b193", "value": "768:C8m/Z6sZjWsYuSwnckNuRMeUYSwCvmBgqEse4l7T2OTfVOueT3u4OoqnU4spTFpf:CPXZ6uSEYWpTF24YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919312, "uuid": "5410dec1-44c6-4690-a693-4756fb3bb615", "value": 136052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919312, "uuid": "cc94d850-202c-42fd-b3c2-852ea352a46c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919312, "uuid": "688afa1c-1397-4d5d-aeec-73402a81f020", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ed1c6a-111d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771895576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895576, "uuid": "e77d081f-8ce0-4761-a449-4668aedfb259", "comment": "Malware payload (Mirai)", "value": "d677376267131798e6cc75e7528a4d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895576, "uuid": "cafa04c7-6d3a-46da-a149-7a2354d6681b", "comment": "Malware payload (Mirai)", "value": "a3a4aa9462899732b39c63db82ac0c5ec6d533694b9d2e89d58b142ae70f3cba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895576, "uuid": "2e5394de-a5ac-4b0a-9f64-3c64bc496366", "comment": "Malware payload (Mirai)", "value": "e6b94715fdd9a7a7e7b3ee1c84c3b8e56ac7de58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895576, "uuid": "0f455724-948a-48fa-9a46-d7fbaf5b8eb2", "comment": "Malware payload (Mirai)", "value": "5c26617bc07f06ca61d6945300319d8b205a865e9d6f025efc54261448b2d1025a598a85c1d4f02d3ece97fe5b361a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895576, "uuid": "d2e589d1-3c26-4817-9afd-744b473fff75", "value": "T1DAB38DDBF7472490D8624AF007C71B9E2E633211CE5BE4E3AC1D3A3A597A1DB190A7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895576, "uuid": "c80ffb86-848d-40e8-ac52-51268b702daa", "value": "1536:6tjltgCnaPnQ5iliLcK0/9nmUhlYL6NPGgkhyV//LWl:MPgCniliof1mUhW6NPGgRV/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771895576, "uuid": "5417908b-87af-4480-b561-9c028611a93d", "value": 116340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771895576, "uuid": "988a4a0d-aaa0-4863-b78a-d43095e6b975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895576, "uuid": "e6245f98-5453-4365-9b08-028b799abcbf", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a01ab15-1187-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771940845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940845, "uuid": "000c21dd-2e2a-4341-8b2a-dbe5b2424828", "comment": "Malware payload", "value": "7161dd9c870639634704804a3602206b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940845, "uuid": "afe3e058-7ad5-4790-b99b-e0954928f7fc", "comment": "Malware payload", "value": "a46b7ebce2aa485281627e65f22db9cf778c2bac4dcb28b0ca4b48bfdd58f0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940845, "uuid": "665b223e-8390-40ed-b9b3-8132860578f9", "comment": "Malware payload", "value": "d9dcd48177938a6c318d8cb7c06e41daee47b530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940845, "uuid": "298ba988-a69b-4409-a27d-585450610173", "comment": "Malware payload", "value": "f7bac89c35762c31cf65263088dcb851bc9327a2d4100e19bbce8d1f2d63ef99c6ac04530e287a25f0559c4831a24d3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940845, "uuid": "b95483b3-cfa6-4f38-b26a-212461a20d33", "value": "T179C423E71E8919E446AC60AE5B54EC5526DCF4348F339C0C9ED008C9B6A1F7AC49A3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940845, "uuid": "336467d9-4a99-472d-888c-6597675445b8", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pTUUa6qgOJuWBy0:yaOwVvvYm3CwpbTqfbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940845, "uuid": "3a98bfb1-924e-4730-9580-dfc1e137c4e1", "value": 573180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940845, "uuid": "66178d3d-bb61-49fc-b18e-fc94b3ee6cc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940845, "uuid": "23d918ce-b274-4a7a-80de-bd036dadc45b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adcb355-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919318, "uuid": "37a7fc7d-0ee6-4c90-bd83-5d3c0238f551", "comment": "Malware payload", "value": "1267cb107e25bb707a3cd053e8799672", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919318, "uuid": "bd6d6190-3574-432b-8f32-f23cb397078c", "comment": "Malware payload", "value": "a472dfd7c10f0a2b53bff3664393caa2424a9b78b0731fabd26bbcbb3a6d276f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919318, "uuid": "88381ff0-5c3b-48ca-a9ce-d9816fa6700e", "comment": "Malware payload", "value": "57648aaa29a55cc9c5490dff98f1aa8f95e9c7b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919318, "uuid": "c7a82a67-7e86-4e95-9234-1839dabc0c39", "comment": "Malware payload", "value": "2e38830646c4a002d7f9c0f65748115714314eb85ef7c88d7ff2713704a5847fe21c3035cc0cf7f53ddd4c5e939731c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919318, "uuid": "c49c2649-1833-4c6d-86e2-ca17c6bde731", "value": "T1EBD3C89EAB302E04D7A31D688CF1518E4BE8EE45DA8EF1E4257DCE781948F09D40DDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919318, "uuid": "1d46813d-26bc-4e77-be48-5fd51fff5cd1", "value": "768:C8m/Z6sZjWsYuSwnckNuRgm1xfAKCMD3C6guQndq89Wp9RyLLEMZ61cM/N3Bf1gR:CPXZ6uSEYShAp5F4U4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919318, "uuid": "77e2b3e0-074b-4648-a4ad-61dd82c11edf", "value": 138927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919318, "uuid": "01bf82d1-7b92-49ff-8288-c2ce212cf7c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919318, "uuid": "4dd95517-c875-4e3d-90ff-a4d0ea048afa", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fbffd9-1150-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1771917078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917078, "uuid": "3d262ada-1d5e-43f1-a9a8-05b720c71eec", "comment": "Malware payload (GuLoader)", "value": "b73179be98239895d3c4d6ffe1a6a6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917078, "uuid": "eb1704dd-19ea-43db-9f9e-1cacbfa6a850", "comment": "Malware payload (GuLoader)", "value": "a48d589f38b17090308566abf94f5ebd1a8263e7052cec2784f5e9dbfe04dcbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917078, "uuid": "0137e260-59a6-4f52-80d5-1089a2dbb8ef", "comment": "Malware payload (GuLoader)", "value": "2626edf8a2a91664378ffa49506a7282f8ceb0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917078, "uuid": "a06fe50a-11a3-46de-8fad-af70dfe000be", "comment": "Malware payload (GuLoader)", "value": "8ab3dfe94182576d8c14ced2b2a6155801787253fac541dfa1f6edee2ca44b848df8ed09dc6673524b840198bcdedf0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917078, "uuid": "971da1cb-0dc2-48c7-99e2-4920f48f38af", "value": "T1E2B4232A1EC69C47C54A1EF32637A243EBBDD8852431D7431B20E70CBDB73A985917E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917078, "uuid": "c96e43a2-486f-4698-ac0a-54a06b377c61", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917078, "uuid": "fd94ff6a-6be3-45e4-b37d-39a488c5c479", "value": "12288:a1yDJVfppRDy7CfTWDJPr+GB6n2rxIc9MH:a1yDJtppRDyA6V+GBW2FIc9MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917078, "uuid": "e17b4961-9248-4d8d-a6f6-1110354f4699", "value": 532512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917078, "uuid": "393b80ed-70c8-4f15-ad63-8a30c528492f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917078, "uuid": "89df1bd7-25b0-4e5b-92fb-7a67e447ad1e", "value": "FACTURA PENDIENTE DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099eb840-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960467, "uuid": "c2caadb9-c057-48a7-9740-fcb6aa18a03b", "comment": "Malware payload", "value": "dc5b7f8f482851a533491791e4394073", "object_relation": "md5", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960467, "uuid": "e40c9126-f963-49e0-803f-da98208be4d4", "comment": "Malware payload", "value": "a507503129c52779d14e00655060897ea9e4c1b98243fc531f8caf0376e7290f", "object_relation": "sha256", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960467, "uuid": "a0d91ee4-19ab-422f-af3b-1ebf11aceb09", "comment": "Malware payload", "value": "0ee1af48d609bf65639af34d32d027f31479673b", "object_relation": "sha1", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960467, "uuid": "e330a8fc-d35d-464d-b4a9-259b04e8e43a", "comment": "Malware payload", "value": "d1c1c97720a6385ab5ee776007ea21d1179c370facc734bb806db43c134829dc929c39ab9a0673f6e38b565cd3a684de", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960467, "uuid": "9e1a43b1-7a75-4fd5-9c94-c6c365fb8fe1", "value": "T1B4B512996F842089D4732B34C4E293256336BFF97A6B4B1701707DB4FB122D12976ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960467, "uuid": "bcb89cb2-6ceb-4e51-8eb5-c90c54b61539", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960467, "uuid": "25381f97-550c-4b5c-af3e-0837b76f5af3", "value": "49152:cS7aEXSRu0e+HC+gnrR23e5ygklm3bBv5lzLC7NlJXaXSht:cS7aEXSRu0eqC+gnV2k8g3bVfzOBlVao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960467, "uuid": "eadaeb63-03bd-47e1-b2fe-bb5eabb8c4dd", "value": 2362880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960467, "uuid": "f5e68bbf-ce6c-4f39-80da-d1c1f8226126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960467, "uuid": "bb666a2f-4074-4072-9ec1-255e5d4b9142", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4ff77c-1131-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903890, "uuid": "3c6b49e9-2771-4c77-b56e-81fb239a4061", "comment": "Malware payload (SalatStealer)", "value": "77d90a6f925753ef3fecebd8ccda25c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903890, "uuid": "14312f87-7f9b-48d2-89fe-9bd433913a9a", "comment": "Malware payload (SalatStealer)", "value": "a5ce32fb44c85b2b675fff4db924cb93481b209406eb09a8a2f1f28482e2f0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903890, "uuid": "a64ca72c-94e5-4582-b9fe-4c977a42f5fe", "comment": "Malware payload (SalatStealer)", "value": "3d7b0d15549c4e737f15647646250edc19877d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903890, "uuid": "ec0f0dad-0c1f-4afc-a713-6e6185b6f380", "comment": "Malware payload (SalatStealer)", "value": "d5282c9c7a9109967ef375ea385241f642315fa40457e04f4c02af63ed1f712f9cd810f4250169cc37c53f843c357dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903890, "uuid": "fe6b909e-1220-4c63-9953-123f2eb95de3", "value": "T113C65A11FA8B54F5E9031831415BB23F33355E048B68DBEBEB547F6AFC7B682192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903890, "uuid": "b31c3553-d7ba-44ae-a5d8-01d7ea95f57a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903890, "uuid": "f460f9e3-a335-48be-8e53-3532ce5be4e7", "value": "49152:Yktj0EJOQhLd72O+g2mU0ynPOn36x5iNR04TEF/lxNz+0ST///6l/pPxwzEYW2Qe:dR0EJL7ZHTEF/V+0mOSIY1F+nee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903890, "uuid": "c352eb55-d3bb-4e74-b8a8-77ae395aba1a", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903890, "uuid": "12a4852e-43d6-4a92-809f-0a5d4206c013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903890, "uuid": "223097ab-1fd7-4f9b-8bb3-650524519491", "value": "RobloxChatting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3198ad-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919374, "uuid": "40955f50-0bde-4f72-8dd0-aa06ba92b062", "comment": "Malware payload", "value": "f79110480f0c6e793c3c8c160192fa8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919374, "uuid": "f68a5f11-81d1-4282-880e-b00eb0aa2c55", "comment": "Malware payload", "value": "a5e827693c4ee61c3380c8933cc1a325197aab719b56108877d5fc050d368044", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919374, "uuid": "5bb9b28e-cadd-429f-9015-d50664770e3a", "comment": "Malware payload", "value": "1220dfb152d2d56570e5accb5e07df74a70724e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919374, "uuid": "95c7d386-2cd8-4f12-980e-96803d6a09aa", "comment": "Malware payload", "value": "1444dd4a7a7fb8f546effbd2f526f9e448fc4e95d78ca2d6ae0723e413ce706cb87a68549a2efb70e2a7bc8a5a308c24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919374, "uuid": "482d3c81-8ad7-48d1-bee6-1ee85b785841", "value": "T128D3E9171BD62A6612CE5ADCB4B2D32A1F6F2BB608341E80D747CF2862F5A01F4739D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919374, "uuid": "14fb86f1-e387-4845-a760-80c6fae54c33", "value": "1536:CPXZ6uSEYQwU5+cU1KzC1CKXs7j/nr2hr/7a7yegvI+l5LIeFpOk1L+5+kaU+W81:CPXZ7Yh4p14YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919374, "uuid": "c5666856-8bcc-4a70-be52-fd8d42184032", "value": 138002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919374, "uuid": "f5c29b2e-d9e2-4b7c-b328-b830190a8c56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919374, "uuid": "c40453dd-850d-47e8-ae60-5b3128874c51", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ba9f16-1158-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771920806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920806, "uuid": "1ee5b44e-9430-4d09-9fdf-213cfa0e8337", "comment": "Malware payload", "value": "7f38b15579a0f15c229a1add0c7423ba", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920806, "uuid": "920ddb32-ae19-445c-98e5-ec319b0b7557", "comment": "Malware payload", "value": "a68d68dfa6f0b0b0cb9c27d44599846436321c7731a11013786750eaca9b2c36", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920806, "uuid": "6087a166-1728-4494-84e3-80c8a9716f0c", "comment": "Malware payload", "value": "4f56db8dc8e6e996d46764e375c6b7c259a4b19c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920806, "uuid": "22302ba7-53bf-4b7d-80af-bece2e3303b8", "comment": "Malware payload", "value": "f46bfd354feaff5ba7b61d0ce8010a6f4f3fcca23376e50f01e8f1bd349f3e7204f2476e617bd4fc277cd4eb1e3bf1bd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920806, "uuid": "72a5eef8-95a4-440f-a67c-92ae08186d28", "value": "T17DC58C31769FC126D66D02B2E92DEE4E953DBE730B7040D367E8399A58308C2573AB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920806, "uuid": "d26d1a40-e00c-4504-996f-00dedfca8fe5", "value": "49152:BNLwSnkxFozxoX/HZB/uFYBdSwug4h1GQu1SBc6h2Xgg8lW8r5YIqSGV5G:0SnqFozxY/XuFRu89r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920806, "uuid": "7dd6fad4-acc9-4dea-b10b-e8bed41562da", "value": 2555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920806, "uuid": "908ed37b-c1be-4dd5-ba84-9ad6f1909e38", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920806, "uuid": "9fb6d9c9-9363-49f4-942b-1b284bc934fd", "value": "a68d68dfa6f0b0b0cb9c27d44599846436321c7731a11013786750eaca9b2c36.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be325fe-1165-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771926245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926245, "uuid": "2de109b2-74cb-48dc-9285-bcd32ee49aaa", "comment": "Malware payload", "value": "83b2ed7821de033fa9fb16850af98de0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926245, "uuid": "3ed25838-1a9e-4a3f-9529-6979f35a4e9e", "comment": "Malware payload", "value": "a6b72efacca579da326d1de1cf3516120e0e657068da94396372e12bc322e9fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926245, "uuid": "3022f1e7-c55a-497f-afc2-841df3c56be9", "comment": "Malware payload", "value": "66ccbe5feb9fb1a3d0ee8503d964d7b991e5ad1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926245, "uuid": "b7068dc3-f465-4c94-a887-96131881c6c0", "comment": "Malware payload", "value": "f407ec7b452fb32a04a15620e15577465c24eaf08c2a791396dfee2e74e8b6d676a1a81f86bf90122f94b337ebb0808c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926245, "uuid": "45e2cb4a-1747-4654-aae7-0c3e1106bf05", "value": "T1A9165B37FAE258FDC19BD170469BC5A3EC34B4A40232797B2685D9313E26E201F5DBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926245, "uuid": "f0f5e899-862a-4fb5-94f3-48c7a7366148", "value": "98304:DIJ3eumbrKIHiSbvp/mQNgkqnG9rhNTG:DGkbvp7NQWrhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926245, "uuid": "06206fc2-794a-40fb-a63f-62b4f6888729", "value": 4247744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926245, "uuid": "e64f8106-0e71-4f41-a284-cc5882b28b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926245, "uuid": "7be8c0f3-8d59-40c2-9dcb-667f2b88965c", "value": "syd-api-01_1771850123_elf_snap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c119f78f-1184-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771939729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939729, "uuid": "1d08173b-b752-4ac4-a78a-c8d93228941a", "comment": "Malware payload", "value": "41e106b698cbc34782edbef840698a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939729, "uuid": "bf0b0d85-9fd2-408b-809f-d434cde3fe96", "comment": "Malware payload", "value": "a6f27e37853d0830f2b688c0ce33050690941a79ad5cfd1bd7176ae4fcb1bdc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939729, "uuid": "88667891-7ca4-44c4-9531-9243d492cf4a", "comment": "Malware payload", "value": "cbf803c8c843f72cc37da0d164915fec1616f958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939729, "uuid": "f79ada32-481d-43f1-af85-7c67f6277216", "comment": "Malware payload", "value": "ebcc88e008e12134599f4be800d3073a83582d622e6f2d7e92a558e39c40e3c410b65220df4ae0933af3a49305299447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939729, "uuid": "7f5343e9-1798-4b6b-a3d1-ccc2a4f38b67", "value": "T1400306069AD260FCD047C5B4039FD136F672B9A9413979BE6BD9DE307A82F14230C3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939729, "uuid": "16c48d3d-dabc-48ec-b927-257fdd5fffd6", "value": "768:NS67t5NDp0Z8hWcyLkIHFxgK0IDG/nEKLmGLs4MzkyO5+hVVV1VVGGi5md9dLaRT:hu84DF0IDG/9T5CaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939729, "uuid": "6f53d8a3-5512-4b29-a2f4-26dea69844db", "value": 38902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939729, "uuid": "a7e96fe5-3c23-49c9-99e9-c260579c59b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939729, "uuid": "8a7f34c4-3553-4c75-8965-b5129b54ae0e", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f65cd5-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952297, "uuid": "2aee70db-fccf-49c5-8961-b08d3b1a29f0", "comment": "Malware payload (njrat)", "value": "6fccbe2464479b8200ee4e6d32a31793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952297, "uuid": "485c354c-ffbc-4a7a-b932-299ca55a7482", "comment": "Malware payload (njrat)", "value": "a70f917a26784cb18d99929f876135fbb885429379cbab2ace6a9525f847bf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952297, "uuid": "51d79ee6-5e80-42a3-b1a6-889b895f6d54", "comment": "Malware payload (njrat)", "value": "f5eeda0a337e8b07ba3be5debd6633f189f1dc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952297, "uuid": "02240b0f-12fd-4815-a5f0-d7717c0f480f", "comment": "Malware payload (njrat)", "value": "9ee196a0e91d549ef78e45be18d88a2d0a58adb16862daf19dba685f2718575c3f559242d32d113d8c9e65f232d85c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952297, "uuid": "d14a4dc6-9cc7-4f93-8f21-a9559fead4ed", "value": "T1C793D84977E86524E1BF56F75871F2004F34F58B1602E39D48F259AA0A33AC44F89FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952297, "uuid": "be9e6a91-970d-4eab-915d-b77a49b9e09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952297, "uuid": "92016753-71f1-4254-94a2-b6a567705135", "value": "768:LY35snhpC0EoQspgnOmWNW6tsX2/ADal2gSXxrjEtCdnl2pi1Rz4Rk34sGdpFgS7:wshpVEoKOmWM6sIl4jEwzGi1dDwDFgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952297, "uuid": "79ef84c1-b124-439e-8a04-58f0aebf5fb8", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952297, "uuid": "af015a37-f3ec-4759-802d-840ae1aae76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952297, "uuid": "aa05953f-7d75-4ab1-8882-ec6ae72cdeb6", "value": "nitrogenerator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e563d0e9-11b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960406, "uuid": "8be294db-d213-452e-a693-8b942010d2e7", "comment": "Malware payload", "value": "b43b93eb5a0bb41ef1e4b9324e770008", "object_relation": "md5", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960406, "uuid": "85ef653a-8440-4dae-b859-bea7d2c98b45", "comment": "Malware payload", "value": "a71d09e0fbcc96e4bc6ee369ba61d50bd77fb2e587bdbd0c5ac51fdac9c97baa", "object_relation": "sha256", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960406, "uuid": "361561b1-cbe5-42e2-afa4-01459d8e11c6", "comment": "Malware payload", "value": "fc77722963b752baa57a3c098928f65ecb9cf109", "object_relation": "sha1", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960406, "uuid": "d8cbfadf-48d3-4729-a385-a8ad224e68dd", "comment": "Malware payload", "value": "e18a4003fba9847c7b33475a10a967374baf6f82d28449eafa6ef3c8b07f2cd0a9d4cd87a71ba5e4229f1fddc774b675", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960406, "uuid": "7d010773-7641-4682-9cd3-8390fe3d5c5d", "value": "T108368C30B441E065E8EE11B2A3FF5AF749796C596F2694C3B0C439DC56324D32AB938E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960406, "uuid": "f1c01231-e376-46a5-82c2-447c7c775a56", "value": "d9fa9ad22ab5bfba6ce0430c19165b7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960406, "uuid": "fb5c736b-9cea-4f7c-8a89-5e43b24c6e40", "value": "49152:+K3/mJPsXLgekqDJIvl/aXOUkrEyFI203HlaMZn+PNLoz1QH6K3cvLim/1BV:+YVtDal/a+Ukgf2aHIMZILY6H2ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960406, "uuid": "73da70fd-a80c-45a1-9851-33ebd7c93674", "value": 5187072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960406, "uuid": "37352942-5d92-42bc-8069-2f8e457b7df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960406, "uuid": "25169eae-285e-451b-acc6-4caa96bb7dae", "value": "python311.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315a8ddd-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917584, "uuid": "65d7e6cf-02ab-4df6-9723-99ce04592713", "comment": "Malware payload", "value": "006efcc73550dc911d1cb8b59c5cb5c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917584, "uuid": "c61aea60-057a-4070-be53-2e65c6fd8b12", "comment": "Malware payload", "value": "a7fa32e9b504b4ad7f9a3b85f6d34f6b474a20d1f5664e69224bbfef6f5c70ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917584, "uuid": "64071eb6-6e55-4de1-b9cc-c034b3ecf737", "comment": "Malware payload", "value": "257f2cc59f019e27dbe4be3f8eec4aeceaec7a91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917584, "uuid": "a0e60553-1918-4534-83cb-9af4859113e1", "comment": "Malware payload", "value": "f95b3df5f5f20fd817627cad597294a4b41fe2a924e369cdc4d52eede90cb28b4cfbc0ff7db32ddcc6eb851e4656e778", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917584, "uuid": "2626233d-9aad-4583-bdb0-657c6e6da29c", "value": "T104D3E96F5A2B013B134B24C4CC766BCA17281BE96FC5FA53CCAD7D6265ACB806E3411D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917584, "uuid": "2ab9c8f2-c8cf-4745-9405-f5b47451a832", "value": "3072:CPXZ7YEhzhbhth6h2hvh4hJhZh/h/hihFhDhOhJhkhlhohFh8hHhFhhhKhsh2pCh:ETddv80x6LPVBgHF03C7azOtzPsmopCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917584, "uuid": "f871fa55-e096-4fd5-829b-85e913c23877", "value": 138002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917584, "uuid": "f3eca248-db9f-4f20-9db1-fcdcb31b100c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917584, "uuid": "fe5ca674-b403-45be-9fdf-47412cb78f3f", "value": "invoice-1645080830.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a569a4-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919421, "uuid": "08362def-0571-48ed-8c94-0a6e65e67ae7", "comment": "Malware payload", "value": "049d99b7713a95a82569314210b0190b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919421, "uuid": "4d2bbb86-a162-476a-9095-5053695c1e17", "comment": "Malware payload", "value": "a8c6be0d1769713fd0f22cd49f04b2496f52d47fdd6d7da6e6bb789b7e03bc68", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919421, "uuid": "071b5ae5-f4d1-4847-90f5-411cef4394f9", "comment": "Malware payload", "value": "8e70e7ead622cb63fd6756f4afe916fd2a2e9cf7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919421, "uuid": "7426354c-f177-4c4d-b885-75a5f23823c6", "comment": "Malware payload", "value": "82360e4eb0fb12e75f103d08d3237dbd9aa92ab48267724951a75cc7b6c1979b10a3b61d64e1719b04dc4d38f7872ce9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919421, "uuid": "340b38d6-d3c4-494e-9759-fd80447d303d", "value": "T155D30963B551D819B3FB62390ADAB0403FEB9ED0551A18F90A39BB7FD91B1AD1009C37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919421, "uuid": "37152695-bc76-44fd-b998-0e72f08fa0ea", "value": "768:C8m/Z6sZjWsYuSwnckNuRoMA8FnpeIixeLScFYHXwz04mYF6F2r:CPXZ6uSEYhFnpa4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919421, "uuid": "9db65e74-634a-47a7-8f05-05be59397d42", "value": 137031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919421, "uuid": "2461b01a-2fd2-44ab-87ac-0d50704c4925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919421, "uuid": "3db766ed-7e32-4797-b76b-96eac289c60b", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04148764-116e-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1771929963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929963, "uuid": "98c49058-90bb-4983-a943-9619539f24fc", "comment": "Malware payload (RustyStealer)", "value": "9141b4306c069a464331fbb6606ad6fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929963, "uuid": "989fea9f-60b8-4df8-91ea-4f5742cb59d0", "comment": "Malware payload (RustyStealer)", "value": "a91717eb37b3dc25c9d2391aca6a1b1f8edde9a3de626264718811ff8113e55b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929963, "uuid": "7e98614f-d917-4e01-94aa-200c0d13990a", "comment": "Malware payload (RustyStealer)", "value": "a3ea4504251a591c85bf20ce8edf7ccd9b1dd10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929963, "uuid": "39ea38e5-f9f1-43d5-b636-fbdfb5ec8cdd", "comment": "Malware payload (RustyStealer)", "value": "2aa47fb978ae3c49d472d212bcc3bca193c999d6c3bd03aaf036dfd3c4dbf94475bc2d5ab8a21a04681341985e3d4689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929963, "uuid": "829e6dc5-9a9f-4755-a9af-5327e3a76736", "value": "T13E164B13F65255E9C069C17493276232F632BC4C0721BBEB6BD096313EA5BA06F3E758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929963, "uuid": "65da4467-2539-4ac0-a624-16fc587418fe", "value": "e5d57883afc937799ea0720a3a232ea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929963, "uuid": "bddb46be-6632-4558-bd63-be7f0af0d17b", "value": "49152:b6L7C8C+2WJsz/KWMfPYClxKuoP4AKqIJdkwujSEQQx2z6mNxEknS6wYKsC:i20HmG7z/DS6wY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929963, "uuid": "13394fc6-3fa6-49f2-8929-869cb93068b1", "value": 4051456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929963, "uuid": "8380c7c0-5bb4-47ad-8490-3e9fe8caa058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929963, "uuid": "e06cdc72-173c-4ec4-a3ad-fd46af8594ae", "value": "sshc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85226346-118b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771942635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942635, "uuid": "cc46964c-ba44-40c5-b3c1-21804fc24800", "comment": "Malware payload", "value": "511f79aeb45443c259c20f28ef1ce29a", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942635, "uuid": "8c7efa46-95bc-4d46-9e79-cd7775187ea3", "comment": "Malware payload", "value": "a98a528d55bee594f77ffe84ed014fb59ac142966cbb10696b772747deeb1d3d", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942635, "uuid": "d4d3805f-b641-4205-9743-a799b50c1069", "comment": "Malware payload", "value": "b60c9787f518bd75ac972420c6ab36de6ba9b7ac", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942635, "uuid": "3e080f5d-27d4-4e17-ba69-59a3fa6e73ad", "comment": "Malware payload", "value": "0dacd1d63a524f8466d0781c09e11c88327d82f004c26febdbf9a234de8e2a10385c5df4263a15db98e66a8fad1ae03f", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942635, "uuid": "6c09adf3-b37a-4b7a-90d8-b02110ee223b", "value": "T1557533BF791484AADF3A07F3325A9301C6BD8AE8D413B2FB81EA497E5119FC940C5647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942635, "uuid": "d2a4bd28-c137-4973-a31d-0e15240ab98c", "value": "49152:AKqJqEvc1uEm8SGyyQq35335s8/LEVvaC+Hxe:AFvcsEm8xd5H5QMC+H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942635, "uuid": "160cf8bb-aa9a-4f9c-967f-c83337c754c8", "value": 1688301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942635, "uuid": "5cec1ed8-4a70-4002-a174-c35b1da69928", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942635, "uuid": "26653189-9adf-4060-9b5d-bb1c96cb54e3", "value": "optimized_MSI_ba6kku.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a96258-1130-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771903736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903736, "uuid": "d6ff4993-706a-4dc0-b9f4-69ef0c19c493", "comment": "Malware payload (SalatStealer)", "value": "430867f34f2f0b1eb0186f9656552172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903736, "uuid": "e7bf6b2d-d2eb-459d-90e1-e606c014a8fe", "comment": "Malware payload (SalatStealer)", "value": "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903736, "uuid": "dc7e4164-394d-4637-8f3e-1aaf70e5a263", "comment": "Malware payload (SalatStealer)", "value": "b63a962edb35b4d5561e118395fd09a46e01a28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903736, "uuid": "0eb5cc90-0a86-442c-8f54-8f43cea277e1", "comment": "Malware payload (SalatStealer)", "value": "32c9169eabd19ba1550bfcfc83e73fb85f7bed70ca0d9a2640fbb1cb8e6bb2fb3573b35f5de84f0570872af1c053c199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903736, "uuid": "a60566ca-9977-4995-83c0-c1b0147cdada", "value": "T1686733C926D4A6E8D3C34674534E52EA71D2787F56FA58283EC71C02D624CEA0A1DEF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903736, "uuid": "56d87e13-2ef5-4b2f-bd80-15f6b7645cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903736, "uuid": "b8c0a016-6750-4c29-b1d5-6b6391a78f7e", "value": "786432:mf+LHzwSZkohwienPCH5nSA6gNIkcg0yO7:NTZThwiePCZSzgNI11h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903736, "uuid": "19a3c5e3-d35a-4098-989a-e80a06ea8660", "value": 31461474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903736, "uuid": "5b4e1b77-4d1f-4b90-89a3-1d9619bffa6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903736, "uuid": "b714f57a-4427-422c-bf7d-0a90606b365f", "value": "34DE06929392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296e2a64-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937757, "uuid": "1a25de3d-2686-48b7-94c5-7ae789a00ac3", "comment": "Malware payload", "value": "dc51ed5c9cfcfb97c29d9407d1918208", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937757, "uuid": "99ff3c0b-1f0e-4d4e-806f-67b448656baa", "comment": "Malware payload", "value": "aae5a39c4ba4e5dbe6057d4b365f6baba494bc79a605c447f2ccb1d2ab62d551", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937757, "uuid": "f6cbca1c-4367-4d3c-a26b-3315c7fc5d18", "comment": "Malware payload", "value": "4e008f33a82df38eb35cb8603db51d8938267aea", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937757, "uuid": "c06471da-120d-4f84-ba62-33dfa5f03bcd", "comment": "Malware payload", "value": "dd61874b273417614190de6ca4c83f1fa5c57e73c5a24522089fa11836a81558d0356a6c38b19ae142717fa7686ae538", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937757, "uuid": "3161cc82-6aa2-40d3-8d07-1346606a1fcf", "value": "T1ECB1703AC04009BAAAD387DBBC87A6907887427F904E2DD0B2DD5199BFC7B1D45990B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937757, "uuid": "248f8b9d-850a-4a2e-bce2-b6cc82cdcf3a", "value": "96:WbV0nt7nwW+lKqHv7YA8wp84Z9Qwp+Ezs5vFHctgIjVijyF8tUrz0RQ0ddE:gOM7HzY2/8ot9iaaRDd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937757, "uuid": "83ed0283-dbf6-4990-b505-14cebf0304cf", "value": 5401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937757, "uuid": "64ee631e-83fb-4921-944c-01150d0486ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937757, "uuid": "726aaf1a-ed8f-45b0-b5fc-beb3beb25294", "value": "setup-worker.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100aa54d-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771916669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916669, "uuid": "7b346e63-d77d-4af7-8275-96140acb8bc4", "comment": "Malware payload (XWorm)", "value": "f07dc86affb08817ffbbb005f3be6ebe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916669, "uuid": "c886b103-0164-43b3-8d9d-16a21bc29481", "comment": "Malware payload (XWorm)", "value": "ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916669, "uuid": "0f599edf-c826-4521-9531-d5c158bb01cd", "comment": "Malware payload (XWorm)", "value": "dcaa8e4cfc2282fd94bdfbea09f37e19af3ce747", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916669, "uuid": "8d1270e9-74de-4baa-ac12-5025c39ffe6c", "comment": "Malware payload (XWorm)", "value": "f4a2b2ae50c432f982ed98f3698dc046e9f70c73e7a1aa2092279a3580f28b59a56f462fae929ce084f32ae9d64112c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916669, "uuid": "75c5fd26-454e-4bc6-ad39-f6e47fb24f83", "value": "T13DC222CCBED6F6A0032271333D1BB326E6EA5C81B14CD5E8F267A19CE994754D4B2B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916669, "uuid": "1fe41e6f-9e53-467f-b793-a78af10451a7", "value": "384:3uIa+5LgWQ23boyC+qd94ZU7HrQdr+iLIKncBl7p339GfoFZj1nG+Cp+Kg6nlC:eIaq8MhCLUsHrQfnsBQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916669, "uuid": "86ceaae7-fda3-4e9c-a38d-6c9567b153fc", "value": 26933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916669, "uuid": "5918de59-ba74-4f94-a139-48d0cc294051", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916669, "uuid": "4f8e66ec-68f3-40c1-860d-d0a6d005f72d", "value": "documento_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd499a-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917541, "uuid": "aeece17c-1a6e-4475-b841-d23f1335c00f", "comment": "Malware payload", "value": "d92db2ed4d3672f7e05f7a1f94544942", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917541, "uuid": "6d545836-c272-41c1-9fe8-001a45bc8454", "comment": "Malware payload", "value": "ad2579e88024c46f3d098601c356663b0ef4bde26d95283839c4113ebe898dc1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917541, "uuid": "002c2359-bd6b-4342-b401-de35f77aea37", "comment": "Malware payload", "value": "9db6d11da52a24515696d8ea4275762b917bc5f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917541, "uuid": "63f1cd67-af49-45d6-93ea-a10cbfa10c10", "comment": "Malware payload", "value": "d9cb7992ef5be53796568d2e1c65cbdc0cccc79eb507775b3ba395c65991470f056417b9ecc3ce9f2913d4d3ba43003c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917541, "uuid": "ee95cb8c-1c28-4884-8dc9-b5173d997f46", "value": "T1C1D3B66B9F738C6C11A5B7340D931213FCB841FE976A41E00BDC25603857479A7A7ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917541, "uuid": "7577d011-4ce4-4837-b091-4928c6f79256", "value": "768:C8m/Z6sZjWsYuSwnckNuRrcFkp2MfnbHxeLScFYHXwz04mYF6F2r:CPXZ6uSEY4Fkp2K4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917541, "uuid": "7b5155a9-d7a7-4710-b06f-72535edba0ee", "value": 139875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917541, "uuid": "6f21bd3d-79cc-4808-ad4c-ceb6e105ede6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917541, "uuid": "ecf5e50a-cb67-40ca-8e20-7a4a1e1266eb", "value": "invoice-1645080830.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e187e8-111a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771893974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893974, "uuid": "cdee519f-f986-4866-b565-aa7cdaf0d14b", "comment": "Malware payload (QuasarRAT)", "value": "bd17f7f08dca89fa5f1b37a062035990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893974, "uuid": "f2b08097-6f1b-4b8b-8503-946af9da49a2", "comment": "Malware payload (QuasarRAT)", "value": "ad45b808524eb9d9e19e7643bce7a3dd0baa58f1049d7a94583b87174cc7d8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893974, "uuid": "285559cc-ea57-403b-b895-0b7711447cbd", "comment": "Malware payload (QuasarRAT)", "value": "b17ead29a7e5faef7dd6f239e87308010ad63adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893974, "uuid": "c9c974a1-89e7-437b-a75b-f1b83ef5389b", "comment": "Malware payload (QuasarRAT)", "value": "8f0abd5fe3b7f01907a71ad215e733c61e239ee269610824c91076053ea584607c75463d7bda5b38c2603d7ab0590f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893974, "uuid": "bffcf94b-4187-43b1-929c-57ed6f3ebf21", "value": "T1EBF52319EDD0DB23C9556C778A11036032B3A84B9391F352F8C8E5E9D4B33A09F56BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893974, "uuid": "e405277d-2c2c-4521-957d-9aab3c4f274a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893974, "uuid": "c5b86e9f-4c45-49d8-a598-82c0b2fdbd6b", "value": "98304:V8A0+e5aoH9ldt4fwkQHNrMCChvn1s80GAj9SbiUUcbJg:90h5auLS4kQN4Rx1VwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893974, "uuid": "662ec2f1-aaba-4918-ae39-d39eef8e5cf2", "value": 3503104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893974, "uuid": "e86ed9d9-40cd-4d44-a928-9b0aea076d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893974, "uuid": "c9d3e454-48ba-44b5-a121-7ee41d419757", "value": "SecuriteInfo.com.BackDoor.Quasar.307.23654.15269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ecf682-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919491, "uuid": "fb69d04c-a4d0-423d-8106-2e8da6de4249", "comment": "Malware payload", "value": "69c2666277ed6d490ce7e45a7ed8d70f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919491, "uuid": "3a3553df-b78b-4521-b493-536b708b83fb", "comment": "Malware payload", "value": "ae1f6fb705d2e54d60d9dad4acaa1cc9da99a47545dbca038d0fbc5a721c1c9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919491, "uuid": "241e486b-e302-4065-a5b4-6d0b3de1e40c", "comment": "Malware payload", "value": "64aa1134d4df37b8888743a250fd224e9d58d6c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919491, "uuid": "bac60ac2-b79c-4dbc-b7b5-a0d4578c3ccc", "comment": "Malware payload", "value": "74f3774ec254ebadedc297a717e5d5eb7d51fb93c2077475d6a4e96ccbdd6a676d8f4ca760f2de9a191e3ac05c2b3e6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919491, "uuid": "d7802c43-173e-407c-9d47-9978d60dc1ad", "value": "T192D3C7F01498B879F963631C16C1B3AECF01557E02DD6AC953D6A3AE5CF44ECE9BA102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919491, "uuid": "775a1f87-19cb-4f1c-8e7a-2128772f3063", "value": "768:C8m/Z6sZjWsYuSwnckNuRbCH5YSWLHgE7N29y4jopS7pFCzo8XFVLv8ndpg/uYdM:CPXZ6uSEYMpXFm4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919491, "uuid": "a0de0257-7e16-42a0-a1f0-123de6c739a8", "value": 137975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919491, "uuid": "644dd97f-5d82-40f6-a89d-20665e8b2924", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919491, "uuid": "79316be9-d8b1-4ab0-8e7f-be13df29a60d", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711b8b94-1178-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771934441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934441, "uuid": "1b2d7352-be45-49ef-8114-776c4af747b7", "comment": "Malware payload", "value": "94bda59abfbc71e81eb64cd80bf5c3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934441, "uuid": "1a4975b4-3589-4aaf-b0e9-4f5f7c0769b0", "comment": "Malware payload", "value": "af607e275da4a3bc9bfd365e262addf5d17e5ac83c9cef9bc9e535394a3ef59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934441, "uuid": "9be3fe60-cea4-47eb-a77d-b12ae507c7f8", "comment": "Malware payload", "value": "ad930001110ea09734d2e325760ff634a811df69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934441, "uuid": "ce54bbe5-fa69-401b-a5f6-e4d16ae2ae5f", "comment": "Malware payload", "value": "0b50857fb088e412b0193d330e6b891326cdb3dac6fecc7b929345983dce6722b4d5b4b18f353b0275b85a7ef360b889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934441, "uuid": "b7dc7fd7-beb8-4459-92cb-65f1d579fe13", "value": "T19B832A3B8997507AD296CA79C9834D41DF73BC8A4B8577CF53910DE20E666D0AF3E202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934441, "uuid": "abda818f-199a-4b93-8250-9504b27f29f6", "value": "5949b1ac49f198cdfa706b8bc2ff5455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934441, "uuid": "777cc437-6771-4022-9b3b-92a209f5742a", "value": "1536:C2afCnLQtqORiGxaaceZvAYD3NrKq6+9IHCm3ci5:t8qVGxrczYZz6wIb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771934441, "uuid": "951ffee0-2bee-48eb-a6d0-b743361d2130", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771934441, "uuid": "0f4737b1-42a9-4596-9304-674dbb568dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934441, "uuid": "9d838f90-92c0-4e86-a935-47ae7e6264d7", "value": "UpdataThemes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33583806-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950229, "uuid": "2dca2f77-5507-46f2-8c03-26a72adf3669", "comment": "Malware payload (Mirai)", "value": "040e2b16fd4c8892d6801185288bc6e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950229, "uuid": "c4d51bbf-cb8c-4662-aeb9-7155e4613f33", "comment": "Malware payload (Mirai)", "value": "af8696a4496b96f664ae27592a8cc50a8359f737d5b9d4341570411611e8bb58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950229, "uuid": "37f5d2b2-3dfb-47f2-947c-d9de611dfdf2", "comment": "Malware payload (Mirai)", "value": "438820571496ce944a734376dab9cfef3efd1c79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950229, "uuid": "48cdc5bf-518e-49bb-9467-2ac15a7d0751", "comment": "Malware payload (Mirai)", "value": "9aa5064ab505ed198b060604dc88d5fc74847fadee7b496e5578233e2db24e223b749b90aba6fe7aabc967131969d2e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950229, "uuid": "f06fe40e-39aa-4c5e-b5ac-834c55c68322", "value": "T1F60171A60EF5C473D95D9E8E7371C685507C6EC93CE41E2DB1C49EB38806614384BA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950229, "uuid": "46540939-939d-4940-9a53-2b158ebce809", "value": "6:IOnFfle6d213wd2UIay97Q635at+7Fb3tFDaJF5uI3Iaen3paNTP8e3a8aaeQ:kNSxy9BYg2djxgIaip3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950229, "uuid": "3663cf74-36fa-4d6b-adb9-f509590f9a33", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950229, "uuid": "e96dbab7-731e-4624-ae84-327915593bbe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950229, "uuid": "e5ea5a83-c5f9-4001-8f77-a5a5f167de10", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa755ac-112a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771900903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900903, "uuid": "4b7b976e-bd32-4b9e-9542-2d42aff668b2", "comment": "Malware payload", "value": "b17d921604b55239bf365216ca2c2b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900903, "uuid": "3db2e3a1-48ba-47ff-a953-d45dad44de0f", "comment": "Malware payload", "value": "b0017c195dea1e1b4a42b7854fea8d23118889a7311d6316d62ec6c59b1b853d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900903, "uuid": "db21aded-6ab9-4585-b15b-ef1e9856a049", "comment": "Malware payload", "value": "9467e9f3c4437888671a94daa50bb6bb4a2d93e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900903, "uuid": "3c9ab334-6e6f-4b22-8e8e-1b67be5e6b04", "comment": "Malware payload", "value": "a2b00cef7219c3b3da28da5f080fef8de18fc125c43c196ae84a43c595e2b8efaa958e7fd158b52b64faa0f9c32e5180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900903, "uuid": "42a85d31-7680-4c6b-acfd-8a5d6a55e6ac", "value": "T119462821FECB14F6E6031E3144BBA26F63315D058B24EBD7EB447E29F977A911932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900903, "uuid": "9957ec3e-8fd1-45de-a313-b3772cd32ed0", "value": "49152:cXfcOhRy726YJaliRSUrCI2pd2yFz7pifUEyB6eSria3UI5Ey:cXfLhRyqjYwRSijKd2yp7Tn63U6Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900903, "uuid": "8961e3eb-c731-403b-b4ac-9877b724e050", "value": 5726370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900903, "uuid": "69b06000-6b47-4e07-bd14-389c019b537b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900903, "uuid": "16c5b54b-9d11-4bd7-b077-61e7f490dca8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6462aea-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917404, "uuid": "a7a9149d-ad29-4489-89f3-019fd734fb84", "comment": "Malware payload", "value": "4af910c2dda4cda711f2ed452e56f8a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917404, "uuid": "adfd47bd-98d2-40e9-a942-d77814db6866", "comment": "Malware payload", "value": "b1f7c12d68fd9e846aa99e8bf8342ae44058f38d04e8e0724e2460ffc23a4871", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917404, "uuid": "8fea93c6-5ea0-4397-b780-15215bbf609c", "comment": "Malware payload", "value": "3044af1dbde0e6293d8da0a619beadfa159afb63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917404, "uuid": "12285142-f912-4425-828d-9737962a7cf9", "comment": "Malware payload", "value": "f46120714be16f5869f69698da746e58ce37b3039e0749a98c985f952528c30a3cf1719fe06dcea0ebb46da11032813f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917404, "uuid": "764dc4ad-333c-4d8f-bae8-e7faac659840", "value": "T1EBD3D9E5C57492EEE2E6FC6F0F1C741EFE44766C09E5A021B72DD1BA8E064D848C6B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917404, "uuid": "ad8e5d86-9094-434f-9e19-8802c9351a48", "value": "1536:CPXZ6uSEYqTPX2B/Bix3Qz4rvX23gSFeSOKk20s17y2OajJHV7gpGJjwdV7g0Me+:CPXZ7Y+/JpP4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917404, "uuid": "6d22cf6a-1e4b-49d2-aa06-7685ae7c39f2", "value": 139890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917404, "uuid": "067488e1-7b0e-437b-bf00-37657d693006", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917404, "uuid": "c8698b9f-6aed-41db-b120-f0831a9285e1", "value": "invoice-1645080830.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f85d96-1183-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771939145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939145, "uuid": "46906064-6241-40e8-957e-893a6d14ef54", "comment": "Malware payload", "value": "a9b098a040884921cb2c0bea3b3c3476", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939145, "uuid": "51fe8fc7-9c70-4754-bd88-83f35ca3c6a5", "comment": "Malware payload", "value": "b25476b49b9cadc2e1d411611c7d0604a90fd375a597d12c635ae5ce1ed4406c", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939145, "uuid": "ec9d1e78-739f-49df-942d-d088d9d803e6", "comment": "Malware payload", "value": "4e39546b2e81079d31a68969cd44520cc413cdfe", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939145, "uuid": "c449b17d-7354-4091-ab9c-1b974c1c5426", "comment": "Malware payload", "value": "3f68affe200634145ccdcb9cdcf2f006acd3e060e5c66e301811bd03af6c9d81d6764f44e4faca50bbd9e1eb55fd739e", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939145, "uuid": "0cc165a1-9ec2-41dd-8260-e1766ef985ac", "value": "T1EA073352856EE8C2CC72A37839F6DB06A51FE59513726B4F1F3BE6986CAD081430B31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939145, "uuid": "54211f10-073d-4514-b657-08c9227ab480", "value": "393216:BXmcBVFq2lCklve8n2DfkkY3ucN6ON2LcIugmgnhWZf3T18OR:oc9q2lGfDfkNuc8/ZugmghC76OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939145, "uuid": "4c91d2ab-0039-4380-87e8-a44d2b4901cb", "value": 17577801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939145, "uuid": "06717c5f-4ffd-43f9-81b6-b8ea6e9d757a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939145, "uuid": "e3fbdb80-eb69-4555-842c-0ad8a71bad19", "value": "PhF2MA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bac31fb-1193-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771946109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946109, "uuid": "6734f629-66b0-4409-a92c-57f17b8ebb27", "comment": "Malware payload", "value": "2613e94d8ba5876cce803548b51f96e0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946109, "uuid": "9831754f-0420-40d0-8097-0620d3e2d2e6", "comment": "Malware payload", "value": "b25bc18bda9be41df2b9ecd2fa6b060196a842bb90ac17bdb03faf1ba6292dad", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946109, "uuid": "aad5d1ce-8ec4-4c9c-b753-2f1bcadd7062", "comment": "Malware payload", "value": "675482ffde56f183ac6bbe0878e56f42de441e14", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771946109, "uuid": "85bd05d4-ef08-463b-9827-67066609fedd", "comment": "Malware payload", "value": "ab273392d7bdc746f9bdc562946ef2eed9bc164bd0583a80d190441ba8534fa342f8dd06dbd424763352f01ac7f38b73", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946109, "uuid": "067a4997-34ca-426a-ae22-a2471558b42b", "value": "T1A32533C58667F427C0B9612DD85E8B3D98906BAD27508C4CB0CF02625EC2FDFE56793A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946109, "uuid": "d9bbabff-2fe8-4cba-b189-3efa34f8fd6e", "value": "24576:/BIAP3eY5q7cvWyI2PU2n8FByyNO2kxDKEkcGXo3nLg0wUomrGOef8xPdlQ:9mKqOWR8vfrb9kQNwUomrzASQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771946109, "uuid": "955b22ae-8224-44c6-86e8-eb1b9e584cc2", "value": 1042302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771946109, "uuid": "653fe68e-b01a-453a-85c3-6d2b5684aa52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771946109, "uuid": "71d64c32-e049-489a-a674-fcf39f5acaa1", "value": "jalaiyt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad40dc2e-1166-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771926811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926811, "uuid": "053b14cb-be8f-4e0a-8447-e877650aed5f", "comment": "Malware payload (RemcosRAT)", "value": "c37d28823e81d69aa151e1434ab576a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926811, "uuid": "f7033a7e-5832-4a6a-8b97-6f2601eb999a", "comment": "Malware payload (RemcosRAT)", "value": "b2e5e09d27ec9d65ff24ed150ec70445b3827314c529274e23dcbc20b8cae72c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926811, "uuid": "55a6aac0-5881-4829-ab0f-c7f50ce88f35", "comment": "Malware payload (RemcosRAT)", "value": "ff2a330ff293b2b8aab7fca792b939ff37354221", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926811, "uuid": "25c85274-2e04-49de-b220-a402fa56e338", "comment": "Malware payload (RemcosRAT)", "value": "0cb6037b4795b5ae4e272fe4ec8c55f8a917db7b70cc6a1b85e9c6198958bbaabea0ac83f36cc3fb75f134e813d51b33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926811, "uuid": "2744057c-0b20-4935-837d-afc92282097a", "value": "T1FD03F9E19525B7A8981C682BB8052F42805BCA71C2BE404F5B615EDBFF35A957E3C0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926811, "uuid": "9cc50e7b-c334-4a37-8df9-888b7abe2490", "value": "768:U4xK8VpYTFkGnc8YHnwaMYFuSKAOQBzHy:FIYHntF1PHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926811, "uuid": "832878ef-abc9-45d2-93d6-a38528382953", "value": 38172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926811, "uuid": "99a330a9-835b-4589-80d8-590127d65c6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926811, "uuid": "f46a68cd-7183-4034-9c12-4bbda3612e6b", "value": "SOSTENER2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e62c24-1181-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771938284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938284, "uuid": "e071d745-8d79-4f2f-9589-443a53d89a43", "comment": "Malware payload", "value": "ab92595cac0d8f9786799b787e475616", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938284, "uuid": "21c0f1d5-2b5c-415d-ae06-033acb590d50", "comment": "Malware payload", "value": "b41fbd2dd35c5ef051de1c03e98127aedab94678aa38f1c10a530059904a5365", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938284, "uuid": "0b1cf268-385d-4b11-b0c4-bef33819caa2", "comment": "Malware payload", "value": "53c76c56fe28d908317ceee968112846f9a5d08e", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938284, "uuid": "cf58a29f-c680-439d-8ec4-d000f0c3fd87", "comment": "Malware payload", "value": "87136be7b0eb4f606c3633b1b5e2a5226a97a85bfb681e7db5d22938edc4710433b3218b8c27e6475b186a051c1a2010", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938284, "uuid": "d22a4b4e-0aa0-4307-90ae-22fc28506503", "value": "T12BB09BD5554693153452B31B4075D35DB49452590062D0DF6705457BA151191D51D0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938284, "uuid": "daef9724-723b-44f3-a188-8899e5c2e05a", "value": "3:lP/ErUnzhJM5OR1RpL18P53ynrNjxl3V7W6WFL5vhc7yn:lP/ErUtTL2pyZ9l34Jc7yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771938284, "uuid": "6ff9ecac-feae-4b6a-91e2-29f67f07ed4a", "value": 127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771938284, "uuid": "eb13be83-9e7a-4ebb-9930-fd34a3685320", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938284, "uuid": "9abbdbdf-c336-48eb-a8a0-98324bbd256d", "value": "Re_0483902492.pdf.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6406a4dd-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771921964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921964, "uuid": "087baf6f-9114-4a91-ba88-a51be2707dbc", "comment": "Malware payload (Vidar)", "value": "97b9ea648b18cba18e0a57e68773acf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921964, "uuid": "36730d01-2a69-4ec6-961f-1f8fdcf26753", "comment": "Malware payload (Vidar)", "value": "b43bbdf8cd383959ab62a587f80ca301e66af67c9673eda6ff901e35bf2afe34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921964, "uuid": "7572dfab-962c-4e25-bfa1-aa25554c738d", "comment": "Malware payload (Vidar)", "value": "c913d4ed08f56376ac74165ef4fc4830631f8ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921964, "uuid": "8d88f5ef-e28b-4ee0-aef4-0076243dbb53", "comment": "Malware payload (Vidar)", "value": "3a8602e1f3a0281cfc60dc4543797ca23ec8413079375e4871898c1bc224758a492e2869187b2ce37378d5ba4bf19d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921964, "uuid": "03ce0f46-6ff0-47d7-b2c9-a7946e748370", "value": "T1DC2423A62A1A5E64CB46D6F607DBBD6B0302CD7368B940EC77EA8F7C9075D4CAC47020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921964, "uuid": "b33399b0-8cfa-467c-81c8-9c80255aa3e1", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921964, "uuid": "e9d3afa1-b95e-4310-89d3-5d5fd48286a1", "value": "6144:DpoLoKrGn4doPaFlqUQmD1zT6ar6bFnQQW9E+VjY3:C86GnvQDzTtr8FnrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921964, "uuid": "fcfe5dc2-43f6-4501-9573-87cdf5e5a950", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921964, "uuid": "0b2fbb59-f16d-4ccc-8dc5-57d7249eeaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921964, "uuid": "f9d2a54a-0759-4de4-8d1f-bd084efb877e", "value": "Payload (9)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed25457-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928934, "uuid": "bdc30596-5d7c-455b-aa9c-7f8845880848", "comment": "Malware payload (Mirai)", "value": "b731972a270f9fc29d6824eb6d136977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928934, "uuid": "41ce8589-ee31-47fb-b3e4-f53e15695eba", "comment": "Malware payload (Mirai)", "value": "b52a90f501e21c8aa7dee2e6731444540d28531ee7f16fc8c721d01c72bbe48e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928934, "uuid": "9c4b8e58-3766-436c-ae9d-ccca358793d2", "comment": "Malware payload (Mirai)", "value": "df125c3226bda028a0f91b8c0df9eeec1e89b6ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928934, "uuid": "0eb44cc4-11e9-4e61-87e5-2a0fa22367b0", "comment": "Malware payload (Mirai)", "value": "ab9c5402794212c7a4e54a85c70ca5bc93839b4c63eee6ee8a7f20a6838e96033bb6ccc18215529c61d80f8dc8ed9e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928934, "uuid": "1f3e3f7d-4ccd-4bd5-ba49-190d538c4e36", "value": "T1A1733A17BA4080FEC899C43843BABA36DC7274FE1379725A17D8FE366D55E601E29C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928934, "uuid": "0d850b1e-08d9-49a3-9b3b-fa99517b6c8a", "value": "1536:DeuIZobGRRINkGIb/+w4HnC+8l8Anzcft:quIZzDIWGIf4HT8l8Azcft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928934, "uuid": "82ef4714-f868-4b67-8a0e-780eb4e43cdf", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928934, "uuid": "c8463646-6727-4fa1-8e77-311ddb4dc926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928934, "uuid": "defa7587-4199-4480-a794-b13b4a56dd1f", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9f14a3-1165-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771926277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926277, "uuid": "db905b18-078d-42da-ba11-a6465f8e5faa", "comment": "Malware payload", "value": "bafe27ae092e0becac8ddf7a0a588397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926277, "uuid": "4167c4ad-d21b-4ce3-931b-748076aa454b", "comment": "Malware payload", "value": "b5ba75004da826f19e25893f1001dbdf9043ce5189a3457bd1e7889b0f88c8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926277, "uuid": "97b436da-1150-499d-b2bf-8ed2a2d25665", "comment": "Malware payload", "value": "dc06102b897330834b6d10f760ba896fbec282b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926277, "uuid": "06a964d8-f91c-476f-b369-27e459003dbb", "comment": "Malware payload", "value": "0eedd4fb74ca0a38c40711efd16dded06c9cd41891933f0ae70fd436d7b7af57159b94bfb9c8ec77de0b95f106681da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926277, "uuid": "fc36e4b0-be93-4221-8203-665af5904ae2", "value": "T1B9E633E38F427136C796D2F237642E7D13BB796236B86756277EB646C98B0001B3C990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926277, "uuid": "acc2f930-7f4a-46ab-b331-981d879ced94", "value": "a413ffcb413e398d1f798a0daa527855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926277, "uuid": "03d99849-82a2-4fce-a87b-392affeaa35e", "value": "393216:2dBOASSQrUN1tgUSAoEO3o3Jx/VJWjw4y:8vSSQAGUYEO3o3JFVEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926277, "uuid": "3f291bb0-20d4-4490-91a0-8b5fe2b90e0b", "value": 14967450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926277, "uuid": "71d836c9-d198-4eef-8327-806bde11d9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926277, "uuid": "c38223ef-8603-4f54-99dd-bf1c707c5ee0", "value": "Isass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404aa4cc-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921474, "uuid": "3b9d0e39-aa7b-4e62-a2bd-aa173af9bf33", "comment": "Malware payload", "value": "20d367286001e5e5e603fcc944b483ce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921474, "uuid": "4d0865dd-5001-4565-b52a-8b9872d3d324", "comment": "Malware payload", "value": "b62e73892d4d3f266a7f0c75cf3746fbaf92948ea8c4565595983ec6c5852feb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921474, "uuid": "8911a325-e127-44cb-a063-6be9917a3f9f", "comment": "Malware payload", "value": "49ac76fdecff88ef37ae6f011e165a4306aa2c41", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921474, "uuid": "3344645b-6733-48dd-99fc-4b3bc933ec89", "comment": "Malware payload", "value": "8e75448cc4a6f3da14891be86aef3291ee206a61563f3ea9bd15bf1b90d2435dca47c3ebe149bde95e563f951e0bde5e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921474, "uuid": "32a955d2-7eed-4010-9b25-31f9ad159434", "value": "T1B057F023F50529AADDD6A135F5E3579532301A540393A339271FE12AFDE25CECA33AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921474, "uuid": "bf3cdd4f-cb64-4fa4-a424-da33271be8bb", "value": "393216:KxfIk5aBVHZV2R+sl7eJ8+DzGJXqDhxMIDfgkTeCmuKZKPIwgkzV:KaMaBDa+sJQTOqn1IaebujlJzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921474, "uuid": "279c35cc-cda7-45fc-b20e-f9b080fa81c5", "value": 27103731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921474, "uuid": "0e7ef544-912d-49f7-a199-956d2e6a40eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921474, "uuid": "e34dddcc-c05b-4d72-9a15-62766e6f5e9a", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee3259e-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896856, "uuid": "a2336940-3b66-466a-87e9-51abe3213c4c", "comment": "Malware payload (Mirai)", "value": "bca8f3a9349186363222590da36e9f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896856, "uuid": "f8ae76bc-8bca-4af5-855a-d7e3c9f17128", "comment": "Malware payload (Mirai)", "value": "b76210f3807c40462f1a8ec65fd3aa65833d9da520256088b57331949872050e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896856, "uuid": "e3f4d958-46af-4073-a170-3d6b7f84c997", "comment": "Malware payload (Mirai)", "value": "4c73aa3f9c04039aae1287c47e63780445c78d14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896856, "uuid": "170c0bbc-79ac-42dc-9bdf-64db7509bd5e", "comment": "Malware payload (Mirai)", "value": "471787a5943d304e7fcd21949485c64ac2160959d95a79fe19bdb830d20eb974665e8bf8d7c6dbbbe334207d16ede4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896856, "uuid": "b04cc2f7-d8f3-4dc5-a4c2-4b3727f40244", "value": "T1A923F1BE020F4486CF94C135A3F47F554E3586FEA0678CAAC819F641EEA547AB813BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896856, "uuid": "87bfceca-3a9a-4b9a-a910-3129a4ce5a2b", "value": "768:pyyTHfUID0deTN1aOzEEBcKk5kOFAkmLypJJYx/0h7dlUa7YHDJtmhgsqeOJgGlA:pyyjfUzA13E2k5kO0GpJJYdM7dOHDTS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896856, "uuid": "cfd47ce0-4db7-4f28-aea5-0cfeb83ec445", "value": 45740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896856, "uuid": "3ad10f56-b6c9-489a-a423-dfb2019b0390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896856, "uuid": "e5657e8b-3497-4f47-a6b7-825a6244a0e5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3941a6-1187-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771941095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941095, "uuid": "57ae5018-6480-4649-82b2-0ef6b57a2ab4", "comment": "Malware payload", "value": "9bb8b2a67f04f749de6c6e038280fe01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941095, "uuid": "eb5cc1d4-a9f0-49ff-98c9-e7e4086a89e4", "comment": "Malware payload", "value": "b7dcf1d156c1d47f27d960d59cceda1fb49276fff182e3078854a08dbb9281cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941095, "uuid": "ad66cd1a-1774-489d-96db-e81b0d637fe7", "comment": "Malware payload", "value": "7582b209ec711be25a0a7cd44c5b1bca516e71d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941095, "uuid": "7f9c535e-6fcc-4fde-89a2-1c7ef29284e5", "comment": "Malware payload", "value": "3b2c493eff01041677592db562163cb99013822507f26efaa9cc9fdcccd1466e432ab786d19efcfcde81f6e7e83e944b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941095, "uuid": "fb66db0c-ff75-4440-b472-94e5ae03718f", "value": "T17F63AE72E3F7D198C1EBC0B85B035BA3EE31785C4668B9D3029582462B36C65A9EC395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941095, "uuid": "e62fa324-e014-44dc-b888-7277ef290c7c", "value": "1536:9ToXtjT4Do1jR+VTkF3js7XZMb8Tv0UM6eKXBwLsy1ETqfvu+P4Rtsj5o:9TwjkDoaVg5iJ0e3MRKXBwLs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941095, "uuid": "5df3b0cb-fc0b-475e-b044-e2bc80f23edd", "value": 71938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941095, "uuid": "11eed2a5-0da5-4f08-827e-f2379d429275", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941095, "uuid": "048fb53f-4123-4ba2-a87f-b75ba493a33e", "value": "shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b5abfe-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917348, "uuid": "5774e8d2-412f-4edf-90fe-5edfd6e75bf6", "comment": "Malware payload", "value": "9a7867115fd9e90b10271b104db2c8b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917348, "uuid": "d5ea6863-b6dd-4858-9a0d-557fd91a434c", "comment": "Malware payload", "value": "b8bb5533f110b85b7bc3b6472474fcb427b9a5231a98e098e7df70b8afb99286", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917348, "uuid": "04e6542f-be39-478e-9602-2c793e66880d", "comment": "Malware payload", "value": "99fadf9200e03aedcbaaf824cb3343e4f401a175", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917348, "uuid": "c17ed2f4-743c-43f0-84ac-8029b69205d7", "comment": "Malware payload", "value": "a6b6469a9274af978601a63ca5f10f41da7195e24aef2c7c0a57fc1cafaa0fe2115a8de43dbb88379916032b4ef46af9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917348, "uuid": "8887eae2-ad88-4eea-a119-3403c6cc7687", "value": "T1E9D3D6FAA7F4D18DE4BF856DFFB0485D01D70321E668463AD00778B6BA085E13E625E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917348, "uuid": "056db8e0-cd60-46e4-94bf-28a4c24bb4ee", "value": "3072:CPXZ7Y+rIAdVP3ThIxm9cKLzdElA1yAUT7VpIxf4xoQnyd7unaWBd2U+NkdYkqqS:EfrIAdVP3ThIxm9cKLzdElA1yAUT7VpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917348, "uuid": "ddced358-5b3d-412d-a124-2c3e17cb057e", "value": 137057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917348, "uuid": "7b41c79c-77f6-4bd4-a38d-d72deb474347", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917348, "uuid": "8a66974e-4a08-403d-add7-fa4ee3798dab", "value": "invoice-1645080830.pdf (99).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd43cac0-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771957440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957440, "uuid": "46c35530-ff77-4a73-840e-8683b47ac272", "comment": "Malware payload (AsyncRAT)", "value": "109b1294112a8cd596004f1dd961c3be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957440, "uuid": "78e5dd5f-569e-4365-9a7d-cd21b94f6397", "comment": "Malware payload (AsyncRAT)", "value": "b8c2e4d4a1946f273f3d178430ae78fe9dbeac19739cde22aa7dd1c1fdf95da1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957440, "uuid": "557257fb-4648-47b1-ac8c-9c02d0eb6cf8", "comment": "Malware payload (AsyncRAT)", "value": "59db87ea176a3ff5bcf071454b5c9e6e619d91c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957440, "uuid": "b6d90ca4-d214-4a79-8f5d-b5e3d7130092", "comment": "Malware payload (AsyncRAT)", "value": "1a430b0fcf44797503de659be1ec2655db420ae7a2449eb63c8102f4fce1b49c377bb7ac6d1f1d8d65763931038d6983", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957440, "uuid": "23b35069-cd1a-45bc-88c8-64c020d7fe90", "value": "T164034D0877944515D5FF7BF96AB365021231F5039A13FB5E0CE88AAE2B677C089093EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957440, "uuid": "891b030f-0b11-4a06-a912-c7c8f23b6a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957440, "uuid": "001e039b-9264-4679-80d8-d1ec454bcec3", "value": "768:7DiLQ/CqHA2mpBrSUQzDYESNFv9SI7OMhpLkvW:/iUuXeUwZyFv9S0OM/aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957440, "uuid": "dddf6760-e4e0-43bc-8223-7987bed5a83f", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957440, "uuid": "11c98920-3d51-44fd-a03d-ac55f2a91acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957440, "uuid": "42c9ede3-593e-49b4-8cc5-d8d8bc300376", "value": "ConvertedFilesol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00969518-11b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1771962170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962170, "uuid": "c57d35a1-2cd6-41d5-830a-10c0b7d6a9d6", "comment": "Malware payload (Smoke Loader)", "value": "b846d20cdc94ad76e774f7ee0909f39d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962170, "uuid": "ab82136c-6238-4d77-8334-e21bf143b8d5", "comment": "Malware payload (Smoke Loader)", "value": "b93484fd64dee8ad3b45ddddcb58e54efaf751f33a12c8807f8d0765e8237337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962170, "uuid": "4ca68675-d815-46d3-85b3-d00a92a97b16", "comment": "Malware payload (Smoke Loader)", "value": "d267c6cb27db78f96e67eb0e820a71832029aafe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962170, "uuid": "bb4254d8-55be-4440-81ac-7e9eb4839dfe", "comment": "Malware payload (Smoke Loader)", "value": "56300419bb184012d6b3f05554b2090d1750ffde35390754ed21225eaf4b34960d203742f22542a6649bb02405f4b01e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962170, "uuid": "8b6e9e66-8fac-4e63-9278-823ca965b4c4", "value": "T1A3A5288A7D8368E5C06A9675BCA216BA7F70BC3C073223D71B1C76382E766D41D75B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962170, "uuid": "48ee323b-dbf5-4957-adeb-badc5256dc72", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962170, "uuid": "b40401e7-e616-4bcb-be2a-8271cfe36228", "value": "24576:LSQDdiyBNffrZ1gJpH7GfIiK5QTjszNOWtPZRp/mdsFsNm:LSQDkynffrZ1gXGfIiVSOqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771962170, "uuid": "c62dd522-d06f-4af7-b98c-b4b928fd4c37", "value": 2116608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771962170, "uuid": "e66f5fe2-9ab0-4eae-9a64-e6adcad85591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962170, "uuid": "424439d1-1aab-4964-b948-68104ea44826", "value": "lRQklBTb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fba926c-1183-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771939136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939136, "uuid": "55844f39-696b-46a9-997b-951fdc27a422", "comment": "Malware payload", "value": "e53cff2b4433ced3975f80b9b2943e4b", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939136, "uuid": "3d4cecc3-ac22-4275-9110-ee3b72d310d9", "comment": "Malware payload", "value": "b98e5a8a59b21bd91a4e0260d8b22357dc7bb0930094e24e2998a07dc547f475", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939136, "uuid": "d69eacd1-18b4-4212-8b8f-dd561b56ada8", "comment": "Malware payload", "value": "3955d987c079d603b440dc72fd5a019de9e35cd3", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939136, "uuid": "84a6ca20-682a-48f2-80ec-b01d92ad0339", "comment": "Malware payload", "value": "30f2f1b25f3d0ae10e67ff9a80847dc9c48d174fbf3a0c33aa141c24c02305ad0ec1ce978940d22d6912ebaca08e01f7", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939136, "uuid": "cc5fa3b4-c18c-4403-85fb-23e37cbe488e", "value": "T107073367826DF8D2DC73E37829F2DB0A651FE69517316B4E1F3AA6886C990D0430B31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939136, "uuid": "18fd7c8d-c4f8-4ef5-9eee-65c924dbe30e", "value": "393216:JXRcBVFq2sqklve8n2Df8kY3ucN6Os2Ly+ugmgnh/9z6udT:7c9q5lGfDf8Nuc82Bugmgh/Uux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939136, "uuid": "7cb69ec0-ced8-4785-b281-e37b6cc5d321", "value": 17586169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939136, "uuid": "d33fdc2e-0333-4357-8847-958857909c23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939136, "uuid": "bb2877b5-ca1d-4fbd-9871-d18363e5b190", "value": "PhF2ST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99a0911-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917490, "uuid": "2675450b-6b1a-4eea-8316-9e901ec30fc2", "comment": "Malware payload", "value": "11047665368fe902e78427106a6d1a06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917490, "uuid": "13bddabb-0dac-4b9c-9bb5-86f8c5201385", "comment": "Malware payload", "value": "bad423dbafb429e846d2ff2844014ff69bf8009a6e45216ed02ff1d239da2452", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917490, "uuid": "3aaf3f62-f980-4829-bc94-7eea321aee81", "comment": "Malware payload", "value": "4f9ed3a158f437e4201dcb0d1a63327841a8aece", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917490, "uuid": "e888e5ea-216a-4387-a1b8-7e27709c4700", "comment": "Malware payload", "value": "8d32d961f4f0a5bf38f3614d7718492f0b1b548ff03efe9d9de4a21ad3e36b9a4bc25f3a4fe4ce941e1d1c7c997ade60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917490, "uuid": "f1d8635d-c4f3-4e94-8e3c-42a9167920d4", "value": "T1E0D3FA9E6C122479EDA16D1FBDD321824287D1EE9997C01BF158BCF1CEA4ADD728E070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917490, "uuid": "4b888a4f-73e4-4831-8d15-c3ed70487f5c", "value": "768:C8m/Z6sZjWsYuSwnckNuR+9RdCm9FVP5F2FiFPp9lFAFLAsuxV0Ju25HE8snQMPZ:CPXZ6uSEYeFPpA4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917490, "uuid": "6a5f238e-e2a3-4d28-a3e8-c994a9ac10f5", "value": 140904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917490, "uuid": "c2677e12-161e-4dc7-932d-73e64566a00f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917490, "uuid": "7fc06103-7fbd-4123-abe2-bfa6afc1c0cc", "value": "invoice-1645080830.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70943931-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771921985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921985, "uuid": "8f4f5989-c8a1-48a4-b76f-b1e1f12a7607", "comment": "Malware payload (XWorm)", "value": "1b5312f8e7538d8f863481989d8f878f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921985, "uuid": "cfbaee7f-ff51-4ef7-b159-09f23760d215", "comment": "Malware payload (XWorm)", "value": "bae904da01bcc20d5f43320e41ec9df43b492c95c89ed7b524e4a050177ad5dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921985, "uuid": "7864a222-4263-442f-b19a-76cccda408f6", "comment": "Malware payload (XWorm)", "value": "6ee95d3732db9c26b436a73324e0206fe941c9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921985, "uuid": "bfce2601-d0d1-4a17-a170-134027051e73", "comment": "Malware payload (XWorm)", "value": "49d46c821a7526f92e8c50bfa9753e0c274bb6e961f105401ed3ecd6f2cf70769123be83aa07bb0de0f54f5c5b07c640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921985, "uuid": "defd5538-2af0-493c-a25c-8585736c7b64", "value": "T1B1F4125BB368B4F9E17342BAD0224512E376B4B287515BEF439842492F637E1CE39F24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921985, "uuid": "38c007b0-1e18-418a-b2c6-39dada410005", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921985, "uuid": "5e6851e6-de65-48eb-8c14-4676663fdab1", "value": "12288:Ir8VpxdYrK8mIqpLypA3Z2mtP2ytjiaJywTCV5ZBfwl6dyd/JoED:28Vd8tqNyp4pP2afyNfwAd0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921985, "uuid": "a3a3a13b-8e8b-4e18-87d8-8f13102c4346", "value": 751548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921985, "uuid": "a0bc7887-8394-4d08-8932-de32f96dccab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921985, "uuid": "87ae91bf-105e-473b-b1a9-739ed97aa58f", "value": "Payload (13)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7227fed2-11ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771971380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971380, "uuid": "7c6fb7c1-3abe-45de-8912-a8e6cc53a05c", "comment": "Malware payload", "value": "8604b7a2bae6f9b94312e8037316185e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971380, "uuid": "e95be0db-1058-4171-a46a-6652e19f3f01", "comment": "Malware payload", "value": "bb6c325ff48b7081513becf7d9ed7468d3c29967da3327e102eed6f3474a2d9f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971380, "uuid": "0adea249-c662-4318-9914-6b9847bc6764", "comment": "Malware payload", "value": "7ea72ae7f6dbfb96f1dfa5a1787768069d93d861", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771971380, "uuid": "0ff2bb26-8a1d-4405-8be4-d736f011676e", "comment": "Malware payload", "value": "14e85b131dac16a82955e7edd00d6ad9cad5f5a768396efcf9d3b3a1e4eceab1f797714f88a4e365f86b4722b9873871", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971380, "uuid": "21d2c274-b829-4e77-bd93-afe17756d35a", "value": "T1CDA3492B23E870F8D56681B4CCE15E52D772747616B1A78F47B0869A4F533C2AE2D332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971380, "uuid": "a2577af7-2342-467f-9c5e-e2afa78a78e6", "value": "b424a4f4c6bec990d2dc637ccd5dd0b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971380, "uuid": "5a63b5d9-0b00-46ba-be2e-a64dc9ebf17f", "value": "3072:s8XWLazPNFETzKS3SEgbPA9J9V5XMB+e2ZP:9XWLa7NyT9r8PuRMBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771971380, "uuid": "55cc96de-e787-4bfa-baab-e85f8deb8328", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771971380, "uuid": "965804aa-fdce-414f-b157-1696940c1841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771971380, "uuid": "e4941ba5-b484-4dff-8c24-7a2c07c56115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f756f934-11a1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952276, "uuid": "235e2b2c-14dc-4b19-ac3b-0fae8be23345", "comment": "Malware payload (njrat)", "value": "8afd07fd674b1065a96c5aa59cec30c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952276, "uuid": "32ead308-9e9d-4be4-a235-5e5f1ccaad28", "comment": "Malware payload (njrat)", "value": "bb962cadd8e5ae8989484e6feeb8f2f97a860ae4c964e5a3efc297a8d2a5e0a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952276, "uuid": "5374af8f-cbc6-4c61-afef-372ff02121c9", "comment": "Malware payload (njrat)", "value": "899e8f43567272f41130bbf8d4a8eb077f23a5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952276, "uuid": "4208d732-76f7-4bfc-a087-e1e044f81b59", "comment": "Malware payload (njrat)", "value": "3916d68c1df45d6ca815fa271b7ab6e642b5c652fb57d16a4cadd81e6c7bf039bf7eeaf27ed2397db3a287f2a3683396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952276, "uuid": "bc878e3c-5c77-4aec-8c92-4b21fe86c9b9", "value": "T1C2E22BADFBE64465D2BC0AB50571950013B8D103E523F77E4ECB24EA2B6B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952276, "uuid": "91ca721a-e113-4a93-b4df-36079904dbe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952276, "uuid": "0148fe79-d40c-480f-b256-9705c19dab22", "value": "768:KJCfqdzNB0zx/6LmzmnAXdvAFQmIDUu0tizvlj:N6KjpAQVkcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952276, "uuid": "557f1067-2b6d-4253-9e82-59b769e48df7", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952276, "uuid": "3bbd883e-a1df-4a49-bdf3-bc082a86c58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952276, "uuid": "3a8e9260-9c66-4491-853b-1c6f76dfad33", "value": "mcpackCheker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d300890c-118c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771943195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943195, "uuid": "e0afc0ca-08e7-4c6c-8eee-7deae48df1a0", "comment": "Malware payload", "value": "f059e9bfc5b9569ac5980b45e3a215b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943195, "uuid": "f6947877-e5f4-4a78-8771-dca09a1044bd", "comment": "Malware payload", "value": "bb9c2d7fc0ffd799b14464e44750266182e624278321e9c18951bb4ca6b77e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943195, "uuid": "77e09552-6025-4d76-96ea-327ef555fdf1", "comment": "Malware payload", "value": "000a760b36960b58d3614f0f45a8c2a11327efed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943195, "uuid": "606f3ff0-a589-4d2e-a1ab-51185b6e3a4d", "comment": "Malware payload", "value": "5ff58a0e5563bb88056301677cee40da5065728eda395d2410f1e71d0b147d87e177d4edfee5f083f8fa313a58b5fb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943195, "uuid": "5544d74f-7d16-455d-aeab-aa8c06d0b3c3", "value": "T14906B084965833E399EA5A10499FD21F52E096504A43BE4914FAFB072BFF7EC770B4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943195, "uuid": "8a7312f1-332f-4d06-8989-8e50752e4426", "value": "49152:8qBGd1qsrez9DkvbjEpjgewkeHjprCvst85/ql9XGx:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943195, "uuid": "7cf72528-7326-4717-bae1-a0fed307606f", "value": 3922900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943195, "uuid": "a0842bc1-59df-4cd4-a246-6665b8fb60fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943195, "uuid": "2e53007c-ead0-43c0-8b77-ad8410aaaddd", "value": "MT1032007369326.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2a3775-1189-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771941630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941630, "uuid": "4aed3765-ced4-4b4e-aa85-a480ab3b0697", "comment": "Malware payload", "value": "8c6834b9674892cefcdb8e9b7abb6e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941630, "uuid": "59cd88e5-772f-462e-83d4-97cd70b41c93", "comment": "Malware payload", "value": "bc8f1a446f5b3a5ed4434c33d8450981afca8f9be415d63ec8b3d9f7806c4061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941630, "uuid": "abdeef0a-090d-4f67-ab21-28e114e19227", "comment": "Malware payload", "value": "ba91ac3c2f8fca4b3443094dffbf77f01f7ebda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941630, "uuid": "7396f2e7-d93a-4ade-ad35-9e620cb10a91", "comment": "Malware payload", "value": "b3435fdc6376ad63752b105462a8490e67e5447b53c79e5ff0506c97df519453d9b36297eac7ce4b3f4d4823871681de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941630, "uuid": "3ad1f346-f692-4f75-b698-ebd826c230ca", "value": "T17EF4224295D59584C094673298328DB286B93CB0DD02E33EC329F97FBC71357AA76B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941630, "uuid": "8ce823d8-6222-48c1-994a-521b9a1f7501", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941630, "uuid": "b8586d6d-1de1-4770-90e3-d5f26b96a7e1", "value": "12288:9z7hU5I5yuNHIgzSFKxWltRohBfSTso93UO+katL1WajHsT4z3V1YpT6Ax2azJrj:9f+iN57Gtene36fFF1wT60XH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941630, "uuid": "99453b67-26bb-4681-88f3-36f449b9ae50", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941630, "uuid": "14d8feff-f985-4d34-8515-589b3257aa38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941630, "uuid": "97cee75d-aa39-4489-947c-21134755baf5", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eed9702-1188-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1771941175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941175, "uuid": "e3e05382-f40f-458b-893e-c07c96f50978", "comment": "Malware payload (STRRAT)", "value": "4ef603f6d1867ee9057ad5ae019d5f71", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941175, "uuid": "6197a861-769a-4e55-a822-fa0cc0f70511", "comment": "Malware payload (STRRAT)", "value": "bddf17d6cb7ffa6155d6c43928a4c5f797160b28d5b4d8a0dc5fb8ec3692cc65", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941175, "uuid": "3c86a5b3-3fc6-40e6-9731-463c4c6cac16", "comment": "Malware payload (STRRAT)", "value": "4f1a29b94730bfc9cfb31fa673858c4354ad4498", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941175, "uuid": "52e5b9b9-6a0a-4740-a36a-294ff1f19aa8", "comment": "Malware payload (STRRAT)", "value": "1d9e66c323fbf75e4bc80128d9a901228e73e4016d3006c45a60111bab041900bf37620abd2770af2c7e57d242764e0b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941175, "uuid": "144634df-03cb-4af8-8ed3-6b3919024806", "value": "T18893CF2B397FC4FCE10B1832306989236A0E56E8D64D211B22FD08725F34D6E9B176CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941175, "uuid": "a0cc4831-b607-4dbd-be65-b2c1e9617ad5", "value": "1536:PUm/f1A3gP1t9Ql1+jWIcB1nGS2Ps8gb0ipLO+jVT1LJhexF2HGvavxbpKHrEh:8m63gP1DQKjoGnPxggi9O+RTIxFvvHLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941175, "uuid": "8d67e329-c113-47ac-b0e4-b1d1dac8506f", "value": 94790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941175, "uuid": "013b3379-d66d-42f9-a67f-4866e6ac1981", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941175, "uuid": "8bf2d5e6-5736-4ee8-961a-a7611dc3378e", "value": "Vev.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3817c660-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921461, "uuid": "6e78f515-fc15-41a2-aa0b-dcd93b0823e1", "comment": "Malware payload", "value": "4a018ad9fba6b3ef0bed9411ca96fa18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921461, "uuid": "f4060358-a774-4c2f-a568-c5d7dd81390a", "comment": "Malware payload", "value": "bea4b1c262380419e79058c48cdaee740012dfa49045ef8e0597e515337f7412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921461, "uuid": "1f3b9770-c63a-4b3e-915c-76e70d0c4eae", "comment": "Malware payload", "value": "210a198736de5de5fed2534d6af368945c9fd6c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921461, "uuid": "ce1d787b-4aa9-4bbd-9b86-6a809844b3ac", "comment": "Malware payload", "value": "bf6e8c35d0fd9e5c2ba02126c3d3925040b916aa1b597b60b8449cce382be9eb781fc618685e2ed78da49deb4f5282f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921461, "uuid": "4f09daf6-4f65-411e-8271-152f702be2bc", "value": "T108365B98BC1DB522EAC97AB42B6541D47335FC48AF4183237514FBADAAF2354CF22760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921461, "uuid": "1762adb4-7973-4206-8e3c-be819e158511", "value": "49152:AfcIWIvVnjtfVzlJwxg6uaiWt2Jj5ExxaUTqk:2cIVVjtfVzlJRWt2TExf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921461, "uuid": "169aa01b-62c7-4511-a9bf-ead4bc50bba9", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921461, "uuid": "1bd020f1-7e0e-4f22-9c10-a828df4e25e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921461, "uuid": "1542722d-dbbb-4198-8862-36feacf12c1a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0861e05d-114f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916656, "uuid": "9ef132a4-c2e3-4c34-8675-38d6ecd2c510", "comment": "Malware payload", "value": "9ed28f5d1bdb399e669d10e1c88f477e", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916656, "uuid": "4a7ea834-dd27-4b33-9aec-5f98cd44db70", "comment": "Malware payload", "value": "bed38d45c308641347f291fa32fa2242ad2fc2525552c54f5abc02551216f9c4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916656, "uuid": "f63b7cb3-e075-45eb-b100-5aa1491f3eec", "comment": "Malware payload", "value": "3a7c4ed691aff8b85443f99e8aa1c302e645db1e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916656, "uuid": "76096ade-76ff-4987-964e-7b74d044262c", "comment": "Malware payload", "value": "6309049301960588b843172cb274dc3ee61c0e20caead202388482b1944cda40139fab0da4f8b4113849c7e63a601f2e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916656, "uuid": "deba3048-8d90-4fbb-8f21-a84a887b2edf", "value": "T18EF31903E2E410FCE1D8C238539B6A36DD36BEC96534659E3B1C3A121BB3E50B61E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916656, "uuid": "2648dc41-4dfb-426b-8af6-4920a0783b26", "value": "1536:1hzPCyX2zEsDI1JLZ8j0dU4VjTQTUdvRwbkGrY7WM92yjqtFlwHXoY:HzPC1zEF40dUGQTUdvR8LY7WwqtbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916656, "uuid": "b6e712d9-42c2-4d92-97d0-31bc900bc043", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916656, "uuid": "b98ce533-f881-4cf0-8e6f-b2c8c20382cf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916656, "uuid": "ad333c36-f278-4ec4-bcc9-fe8c7b71ed4b", "value": "Documento.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d771453-118a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771942166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942166, "uuid": "b3c83be7-2e2a-453b-890c-ed211e6e2a10", "comment": "Malware payload", "value": "27cc1527c17170c993f72a5e3ad98d1f", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942166, "uuid": "2df60c3a-0f49-4790-9d04-edd6a44dc42e", "comment": "Malware payload", "value": "bf7ae0f87268a3fce13ca4dafe95ecac5971e8556c26678d05f0fa9b60110760", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942166, "uuid": "4e08feb8-1c1b-4a05-98c3-1dd796c4547c", "comment": "Malware payload", "value": "f58d0ae5c5a8006821b3ba631c611ebb3c67e29a", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942166, "uuid": "e530fb0d-df2f-4c8a-823b-41dbc03eb23d", "comment": "Malware payload", "value": "ef69eba589158d6cb9fac6a7b8b35f4f50aadc5d486891e927b36683071a61186b45656236bb808782d9c022a7f11a01", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942166, "uuid": "dd94dcf0-394b-4fcf-abb6-0db01bba6f5c", "value": "T10BD4BFB95394AC8F0F1D0E66F50C174A1C6948C7E6BCC2B87A82B4F845661A48FFCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942166, "uuid": "e81217c7-51c4-44f9-bab9-be504cd97f60", "value": "12288:5CjYJ8cdHKMkerLQSK4UQkEF++c+3gv8H7lZEmW1Xlx8:vSYHKfELQSKMkU++c+wiJZEmW9X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942166, "uuid": "06497074-a6fd-4e6e-a230-0d224b7b351c", "value": 641027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942166, "uuid": "25e5abd3-0ae2-40f3-8d98-a21e35a6b0d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942166, "uuid": "395a413e-935a-4a32-a28a-f7df9166fc73", "value": "peruConvertedFile.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c68ee1-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896863, "uuid": "2f1c28be-bbc0-4419-8d29-32e0d40fcd4e", "comment": "Malware payload (Mirai)", "value": "80ef40b45d3c65eaf856eb24796758f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896863, "uuid": "26313b54-5450-491f-b10f-7c7c343fc4c3", "comment": "Malware payload (Mirai)", "value": "bfb3aed6ec1744f5ceb95ac35bdb034b87ebc280b7d29cf42f4ce75e3003fb92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896863, "uuid": "900c6a7e-ff42-4131-bb49-243bc1592747", "comment": "Malware payload (Mirai)", "value": "74baed40e0a62352ab4d262e25f72162f86346e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896863, "uuid": "509691b8-1dd0-4505-a0c6-1f7b6347bdd1", "comment": "Malware payload (Mirai)", "value": "ef522de69dff4e0bd5e58d1ebceb0330d7e43ef9929caecd77ed1a7acbf83c489577c8e55b6ed14f6139688cbcf30d6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896863, "uuid": "9854692c-7a01-4c50-b24c-58e2b8f5b25a", "value": "T1FA933A91FD829613C6D512BBFA5E428D3B2613E8D2EB72079D209F20778781F0D7BA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896863, "uuid": "2eda9d91-482f-4566-a091-3458acdb6d29", "value": "1536:fLlcZgHttAFe8Av6WlELFIGj9B/T5HwQMYDOCE7OitObKYvAu:DlcZg2s6vqGp15HErtWAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896863, "uuid": "b44c2f79-f9eb-4398-b59c-4a44d6093ed8", "value": 95820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896863, "uuid": "a5325bb6-4e9b-478a-a84c-3e5fb088f499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896863, "uuid": "2b3b52ba-9071-4b26-9004-1e60f97f36e5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3baffeb-1188-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771941532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941532, "uuid": "d559d8f5-3a9f-48b2-9961-eac1d920691e", "comment": "Malware payload", "value": "0816b6db39b085e2964fa1219e9457d2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941532, "uuid": "b45712cf-4365-47ea-83df-2fd93f1e6e81", "comment": "Malware payload", "value": "c121749503f0818624d80f124d2c7e1ca1851a9bc7e76580ac76be853fcd4217", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941532, "uuid": "ca71bd4e-c01a-4c88-a05a-2b3643bb575d", "comment": "Malware payload", "value": "0fd84a15f916ed13bf09fcbc254d5781a7919c6b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771941532, "uuid": "3f86eb3b-1e51-49cd-9aa4-8744dc3fd266", "comment": "Malware payload", "value": "4615b563fe444aace8774d79688632d6b6912d1d73e4f4b8d0250c7d32dbc04fa485ca86f0e8a48bc22c040db51703b4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941532, "uuid": "f912631d-0d14-4ad8-861c-8117dceb976c", "value": "T1C0F1B6B9CAA5FC80475F734075E2E8C710ABC9138E635B54E78C18A02F51369EBB898C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941532, "uuid": "a6420fac-87d0-4f25-9dc5-deb9c5dc9aa9", "value": "192:UnjDux60RZL/YUCABPRF8qItCag3kfeVyIQLPS3eD6:cD4VRZLsAKqZ2fuTsPve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771941532, "uuid": "4b8c142d-99b8-4e98-94e6-279b537154a7", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771941532, "uuid": "38029fed-92dd-4e08-9c56-074940243ab1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771941532, "uuid": "acbe20a5-17c6-4708-bb82-b0d7ceff869b", "value": "Offer to Purchase.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a7d3bd-1187-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771940913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940913, "uuid": "94283ae6-9fba-4abc-b225-d6c7a9c64557", "comment": "Malware payload (Formbook)", "value": "3bf1eb251e14ed5d833121f47ea9ef6b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940913, "uuid": "8fb1ed1d-2aaf-409d-9f68-e8ea218b2808", "comment": "Malware payload (Formbook)", "value": "c1acaeae9a4012e54efef137b242810fb9e15a97261772eba2a5fc8153a9a6e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940913, "uuid": "f32f2ebe-c453-43f2-bc1c-2dad76943d4c", "comment": "Malware payload (Formbook)", "value": "db04828eb7d72922459f1435f7172d186f5fdb0b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940913, "uuid": "b5595c71-aec3-47e2-a227-95dfd92cf87b", "comment": "Malware payload (Formbook)", "value": "56e29e5226cda2e3da23336075bbe2994b600ad21ffd71d54c077a25514084ecfd501aebba4636c77ba3e471c7093330", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940913, "uuid": "edc6be52-6d27-4b05-8053-13e0d80609af", "value": "T1ECB423C24A0D58BEDB452F99DFDD2ABDE84158B411CB3165E2C3991F28C93B7A34286C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940913, "uuid": "75069bc4-8a10-4caa-b680-6a2a47574b66", "value": "12288:EWgWWZJ1eiK4hnej+3veFFwlVT5yn6dLnGV:EWgWWZzrh/E4Tonc6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940913, "uuid": "ea27814b-6569-49fc-b94e-6ac004b2119d", "value": 521594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940913, "uuid": "c53a34bf-4cf4-4170-a7f6-52c9ccda1b0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940913, "uuid": "4b78b5f3-f1e1-462e-b8bc-cca2435d41a7", "value": "c1acaeae9a4012e54efef137b242810fb9e15a97261772eba2a5fc8153a9a6e4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9218f0-1165-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771926218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926218, "uuid": "d06fa906-5066-4a46-b02c-57fceb1f48cb", "comment": "Malware payload (CoinMiner)", "value": "f0f585204de1249291796600f02f425f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926218, "uuid": "2c2d2962-970e-492e-83cb-c027de4916a3", "comment": "Malware payload (CoinMiner)", "value": "c1c122869f46aaf8c4e90f3132c93a801c853244c756966952d0bf19241cf084", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926218, "uuid": "85a66e47-2b65-430f-9d5e-407c7b915f41", "comment": "Malware payload (CoinMiner)", "value": "8ac6f17e3afef735377659e1d1c9ab427766a519", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926218, "uuid": "9eea81cc-93ba-49f1-9afd-4e34bdde9ecf", "comment": "Malware payload (CoinMiner)", "value": "e1a5ff7270fc79026af4676289c187b8d756dbadb538576293cb5f9099bcf713932907c7233347e0f5a3e2246d7c54e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926218, "uuid": "d6a32a47-1ece-4668-b2b7-7cb0f4abe299", "value": "T1FE7423AC11A6DB33F61D6DB86B830ED4D1887131D6464DB78EAB969B087D4830BE312D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926218, "uuid": "9ec0a36d-e411-4041-bd16-0e3c8b69b3d2", "value": "6144:lfNbDcJXam4gMDHVSfbbMN7ss4Du6QK3mYAx2yHE6qsaEEb0tTbL8GT2h3Z:jcJXaNgMunMN7f4DAKA2yHE6gEzt3B2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926218, "uuid": "8fbcaa33-aaa7-4584-a10f-12cb7b44d534", "value": 342480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926218, "uuid": "abbc82a7-f16f-4ad3-b15c-fe12851e850d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926218, "uuid": "55f911eb-0265-4c05-8749-dd808b076f4b", "value": "vpn-gw-01_1771842004_elf_retea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce2af5c-11b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771961680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961680, "uuid": "13c85c51-5f86-414c-8c82-f39d9b703c48", "comment": "Malware payload (Mirai)", "value": "e3a3a082c040a784d1d73b4d73df6cae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961680, "uuid": "ed152b42-6499-478c-acc7-583fa69bdbd9", "comment": "Malware payload (Mirai)", "value": "c30838a9516acf254ba9c49309bf7dc3272ff9c397823b585d24e8002d4551b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961680, "uuid": "aa3f6e77-529b-4520-af7e-0950db1dc249", "comment": "Malware payload (Mirai)", "value": "a0c52142caeed4e6d75c4a7578552b92e9a5e38a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771961680, "uuid": "3787be5a-b8b9-4c6d-8654-85f86f879f51", "comment": "Malware payload (Mirai)", "value": "5c2cbb427aff6131e999faaa5d6d9526eb79119368f29aef6bd51d1a851f0925cc35878d96b757c40b60500f4f9bfdb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961680, "uuid": "76967c67-a10d-4312-b662-fee18c34d4c8", "value": "T1F414E716AB510FFBCCABDD3706E90B0139CC655B22A43B3A3674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961680, "uuid": "ac500a69-63a1-4877-9e47-251fb0f2a3cc", "value": "1536:TzJj39WGllgCHGc/JKz/aC7R+4YqofBUx4ez7Mv0JiOWU4+SJZGklEJ8GnTbHtXl:vJj39Wmu39zV7dBlWjJijnTRXlRBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771961680, "uuid": "c02b35c9-eb7b-4d65-a0a0-033698bd8346", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771961680, "uuid": "3dff8c8a-f66a-4dcf-849b-8a0da4719e81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771961680, "uuid": "21e36107-fbb9-449e-93f0-341f8e3abb92", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140fb12e-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917535, "uuid": "429120db-e35a-4f13-954a-ced1c32277cc", "comment": "Malware payload", "value": "d83d90ea8abfd9d24ab7dbcb99616f65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917535, "uuid": "4d8849f5-9e99-4725-b4b4-6b37b60258a3", "comment": "Malware payload", "value": "c4678f0efb4ff3602c3ff0748100e6bbd0733fdc1af54cdd550eab8047049da6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917535, "uuid": "4dd258a3-2dc6-4a5c-8a57-5371f537c70a", "comment": "Malware payload", "value": "f8032e6051d98d64736f795bdd9062ed8626940b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917535, "uuid": "6d2f5fa9-3ca3-490f-8dca-22eca9b2dded", "comment": "Malware payload", "value": "1cf8d7d381a8d919736be5374182dbd88bdacb7a931b0a424a6fa9e2f88a753b4ded39846493b933947ae8725447e27a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917535, "uuid": "3f1659a4-1d1e-4cae-9d0e-30bf600d6ad6", "value": "T15DD308E39B39F50E2511D1A8E576325D2E6C286726D85CE0BF0679396EE007B272703F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917535, "uuid": "dc1800a9-00c8-4708-85bb-dd66b83b44b1", "value": "768:C8m/Z6sZjWsYuSwnckNuRusgdTp5FIMZxeLScFYHXwz04mYF6F2r:CPXZ6uSEYqp5FH4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917535, "uuid": "b1a8c450-6dbd-425c-9d41-372da4271bb8", "value": 139897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917535, "uuid": "28085097-24b5-490d-902c-c89679d1566f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917535, "uuid": "63f5acf7-4d76-4210-b088-aaa15912cece", "value": "invoice-1645080830.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0270cc-1159-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771921090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921090, "uuid": "c17e54f6-18b3-4ef6-91a4-1f4389c06bf6", "comment": "Malware payload (AsyncRAT)", "value": "4ffdf40482a5159bdd97b913423495d7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921090, "uuid": "8ecca4b7-d207-4236-836a-aa9cf76906f4", "comment": "Malware payload (AsyncRAT)", "value": "c4b78f061b46bec02b3df0f8845482fff1c8820a486b59e104ad4ec4d30748be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921090, "uuid": "052f39a6-1152-4628-b504-651593b5fb27", "comment": "Malware payload (AsyncRAT)", "value": "cfb437fb4806c28096537b2720f727108bacbdce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921090, "uuid": "8830abdd-8acc-4f53-9ece-0d2a211fa9d7", "comment": "Malware payload (AsyncRAT)", "value": "089f914e85371b112acabb1f1a0fa56496b0669d08e7a09edcfbed57524271b3699dacf041a14bc323be49e92c6ede4a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921090, "uuid": "aa10eb45-bf63-4dc4-bb09-2ae828f2567e", "value": "T19BD24A08B3D88561E1FD57B94D7293048771EA5BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921090, "uuid": "76cd9665-a137-47da-a0af-636574017d02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921090, "uuid": "e397ce40-6e6f-4d96-8c34-7f4d9b9586f8", "value": "768:naaRXzBBgkYUg/cIRGqom/Rb7fB/dTy/+:aaRX9BgkYF1i4RbN/o/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921090, "uuid": "9a750a83-c8b1-4575-9925-604110278f0d", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921090, "uuid": "4525e320-063c-40b8-affe-b1e9af7a391c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921090, "uuid": "c3858178-6b8a-4960-9ff0-ef02e4e6cb52", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143b3f3e-116c-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1771929131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929131, "uuid": "49f1e312-8f4e-4fb7-b078-e53e24bcd534", "comment": "Malware payload (Metasploit)", "value": "5c256b44a233d26298ed05623da338a2", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929131, "uuid": "101d38ba-cc46-4590-b3db-99a789d85e4a", "comment": "Malware payload (Metasploit)", "value": "c4d3ec9f65b092cb2c8b9a8b070f4b4a8c62c1009d51c2d88e40ba23047e5d0b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929131, "uuid": "ffb77cf9-a309-4fc6-a663-c3db2e72eb43", "comment": "Malware payload (Metasploit)", "value": "37fd6108c452f1e52c6ab2a96cc96b3ec88a19c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929131, "uuid": "b4d5d70e-133a-4ab0-91eb-10da519e7bb2", "comment": "Malware payload (Metasploit)", "value": "d8ad64d7c90f19d85682ffcb28f7f0e54fe4a77c8619de3d37793b46adf6cd6c794925ae37a72cfe85932a27bb90df53", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929131, "uuid": "373a668f-1cce-4980-b47d-cd5eab608a65", "value": "T120227D36B01A4F30D9AAAB74F0945B9AF85C148EF2063D25B315AFB3C9C21CE5264AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929131, "uuid": "8e6cb535-a409-4195-8347-23a5cd3adec7", "value": "192:eEhMOQfFUUp9264wpmGhejb8Q7Z/c+8poF1d3jvvtl8ae6rGxjPmv6:eqNQfFzp92hwYGAjbVcfa7pr1lFpyxjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929131, "uuid": "b6c58821-996f-4275-a7de-8b5056f5c65e", "value": 10696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929131, "uuid": "54075df6-16ca-4bf0-a9c8-a553613f305e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929131, "uuid": "a6df3f2c-e017-4fe5-bb92-f8f550b2cfa2", "value": "follina.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ab4ab5-1123-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771898096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898096, "uuid": "a10a2b45-906e-4630-a838-2af7f2106fd4", "comment": "Malware payload (Mirai)", "value": "f4ce35153a91b43c7fc685cf15a00da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898096, "uuid": "75ec688d-dcc7-492d-9dfe-9d1fd8287add", "comment": "Malware payload (Mirai)", "value": "c577845c7cdc0b209ba76c99bb2a12609094a247f0312e7718ae4a482785a0fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898096, "uuid": "c481227d-b960-44ed-9149-47bc61dd486e", "comment": "Malware payload (Mirai)", "value": "e8d880501bbb78853e1748afbe2ca107b2b6b6f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898096, "uuid": "691c114e-a71a-4047-ab59-ed92491e596b", "comment": "Malware payload (Mirai)", "value": "7dce6b4c9c5a308ede7ffb7ac216285d541e15083e3fd3d162728213990d47e2a0732346d9781f3a51165a7c0d857e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898096, "uuid": "1862d793-17ad-42e6-9c92-98a5c06b8280", "value": "T1F6733A96FD818617C6C512B7FB2F428E376623A8E2DE3203DC156F21338A96B0E77541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898096, "uuid": "e9d42100-4faa-4bd7-9952-fc204e2415f7", "value": "1536:mTtwRsU+4+WYA8QBX4f9YiWvjNJmEbHReUvr7e:mTSRsU+4386KCjvjHxxX3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771898096, "uuid": "3cfe4596-967d-4b44-909c-0b26339cc5aa", "value": 80488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771898096, "uuid": "9f8c4574-466b-4598-9630-1f06ef1c8943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898096, "uuid": "22bf34b6-770a-47d0-bbfd-5f8aedaf1805", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43248de9-116d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771929640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929640, "uuid": "546f2696-1d62-4c2b-a5f4-0442e8c37a35", "comment": "Malware payload (RemcosRAT)", "value": "25ad556e980f70db5f658408a5730c42", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929640, "uuid": "e2456d4c-2251-437b-8104-4c1f8ce3e2d2", "comment": "Malware payload (RemcosRAT)", "value": "c61dc628df5c844fcbbf6a0367295fe718292ef0578d360ba67ecd20c49b36a7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929640, "uuid": "698ab69d-de5b-4b92-ae9c-eaf6a28cce04", "comment": "Malware payload (RemcosRAT)", "value": "1bd2d7c62178476c1b98cd72b350783f3e56df33", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929640, "uuid": "19afbcff-844c-454a-ba84-25e1e123d10a", "comment": "Malware payload (RemcosRAT)", "value": "3b720e07ccde7c91fe590fd3a61f89cd10cff3a948edac46c7d9a4ce97136f7a0e9b469924d68757ecf23f48ba42670a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929640, "uuid": "1499ce42-5569-47fd-9d63-8ecebeb15595", "value": "T19565D405B49041CDF2AC5167A642B10FFBBD9B0B2D923D1AE9314ECB4706E0EF536A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929640, "uuid": "580dd821-94ed-438d-a025-699b93056976", "value": "384:ZtvP8rBtxuHOlnY4e2EwcFG8aL4ER9ZkB:Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929640, "uuid": "29b1c844-5f17-46a6-9538-e55bdeaf3ab0", "value": 1464736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929640, "uuid": "8d1c8a96-8f35-48fe-815e-2c6becdaf89f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929640, "uuid": "4bffc1f2-803d-43a5-b62e-96898ea06458", "value": "sdfiuisdiwewekjfjksdjaksjfkjkjdfkj.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17ab431-116b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771928966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928966, "uuid": "3e35b0d0-2d01-443f-b711-fea14eddeb39", "comment": "Malware payload (Mirai)", "value": "807c13f9cccf015d0cd77599e6da23ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928966, "uuid": "c633fa24-2648-4dc0-9fb8-e558fd946a73", "comment": "Malware payload (Mirai)", "value": "c68e5430c11fb21c764bb256e7c2a7fd1622894f18a5673a35beba00da36e879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928966, "uuid": "798bb21b-6a59-4bf8-b5f5-daa0d7d5ffeb", "comment": "Malware payload (Mirai)", "value": "b206bad9d9f9e202df74e4124c2db5128812131d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771928966, "uuid": "3373f6cb-a7e9-46b2-a590-c155ba1c7bb1", "comment": "Malware payload (Mirai)", "value": "1a9d1b1e4ecea6094511448b78305add397c4e8d32acdfc98a3dc36fbaf38f1acb475b06c2e9fd683822f8baa612069a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928966, "uuid": "d5588463-ef4a-4c7b-a223-c8fa7d130c72", "value": "T115639E16D82119A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928966, "uuid": "454e8270-99fb-4427-a915-bf0228b80c1e", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udX:dWVkwgAYugsz9xznsxrdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771928966, "uuid": "66cad1e7-b320-4916-85af-efd2acc3a1d2", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771928966, "uuid": "c9ddf774-9a66-4a28-887b-2319613f828b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771928966, "uuid": "7b088328-50db-4432-a69c-b415113ac0f6", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da7c698-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1771922007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922007, "uuid": "df79fc3f-c4b0-4ce0-9da6-af61dda22d9b", "comment": "Malware payload (NirCmd)", "value": "9162362f235e0ebf3690e2b55fc03ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922007, "uuid": "4aa44347-e8b7-427f-82bd-abf9d279c626", "comment": "Malware payload (NirCmd)", "value": "c6d3a4132cb1b22bcfde151893196cc8f96d74181ec22aa31306a6b799628cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922007, "uuid": "3af1bb96-3000-4793-9a31-a71037e9a18c", "comment": "Malware payload (NirCmd)", "value": "10ba710fe158fbaaf2d06214c5ea75aa459d1e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922007, "uuid": "593c7c95-a316-4db7-acaa-908c52f40656", "comment": "Malware payload (NirCmd)", "value": "9b431fd02b6d97a131204cdaa8454db669440b628f441b15afbf74a42267359a2edcedc9a0ff49bb832cc5ba9ddfe97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922007, "uuid": "d2fc389a-cedd-4f96-98f4-34c63ad4a063", "value": "T12FA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922007, "uuid": "87e825a7-0698-4afe-a432-f9ad3333c1ce", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922007, "uuid": "3f6c6a0e-338b-4d90-957f-2aeb1ec6e197", "value": "49152:ABRhTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aDTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771922007, "uuid": "52e8de0e-4742-4d9f-8012-ac3b2d43f722", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771922007, "uuid": "daffc3a9-2978-4dd7-b1ec-803bc8627823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922007, "uuid": "e0c7c377-b80b-441f-a3e5-c2a1084ec5b0", "value": "Payload (17)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555ea0ae-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919362, "uuid": "d7d51252-456b-4090-a8da-a768ee0e43be", "comment": "Malware payload", "value": "043f31f14915863aa19256b39ff8df6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919362, "uuid": "ff7cabc4-28ea-4391-944c-e822f32a173e", "comment": "Malware payload", "value": "c74ec2a6d3fbc82d78968d3b7cca535fdbcba1016da49c5b2f37dadc98dd7f19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919362, "uuid": "1292fb23-66a7-4c0c-a22a-51e736ee0027", "comment": "Malware payload", "value": "c9bf86dfcecba7e4aa7d37b9b70647f929bf3aea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919362, "uuid": "3deaaa1f-d1f6-4729-b67e-dbb25b671063", "comment": "Malware payload", "value": "502393d4d33d463e8bda76cdad47a121f77379f3e4b775b7eec3a8a52934693879125fdeab539390a9e193d2f65d6dca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919362, "uuid": "c6800686-78b1-4495-a2de-4f4316282539", "value": "T1ABD3199CDB76B99D0C938FE9E90D340CB54A69F09DB73BB2C12538A478D1CE4451B82E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919362, "uuid": "b79d965f-39f1-437a-ae33-adb43fc32637", "value": "3072:CPXZ7Y3ANeP6slr35NsSAghxIUGRqHRNi/r2+z5BZ/nkqZIp4zPF4fP80HHfP9Qq:EsANeP6slr35NsSAghxIUGRqHRNi/r2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919362, "uuid": "3efc37bc-a3e0-4404-a0d3-ed7965ca4262", "value": 139901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919362, "uuid": "c3591494-fac2-41b9-b6ba-e9bbbd0d1174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919362, "uuid": "21cf6e0e-e6c1-49ed-be4c-ed130e8f14c5", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cc96e3-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771916697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916697, "uuid": "8f7e1eac-af75-4c6e-a9a4-9d5b7bb48f34", "comment": "Malware payload (XWorm)", "value": "c56ecb47e6cecfabf80b6649ff666e6e", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916697, "uuid": "c2f9a12c-79fb-40aa-a934-c453e9b3457a", "comment": "Malware payload (XWorm)", "value": "c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916697, "uuid": "bc7cc796-ef40-4087-ac40-52994eac5ad2", "comment": "Malware payload (XWorm)", "value": "0b6512e044da89ddededeb7793da1595f7b3f2d3", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916697, "uuid": "3bfdddf4-cc38-410c-b3d2-0db555366e8e", "comment": "Malware payload (XWorm)", "value": "5cf9e2efb7d077f63bae207cc0e4d3ee875ce47fedddc6b784cb7769030c6e15477c759e05a70f07becfb7431163d705", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916697, "uuid": "3202729a-16a5-442f-ae3c-735ce78d1a0e", "value": "T15432BFC04252B852E8A9D935E301E6257CB1AD1E02E3DD3CFFD05759CCCF619818B6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916697, "uuid": "3ea2305d-6c47-49ec-a9ce-ece12be57843", "value": "192:C6Y1coTUTc9I8anGunprFz9x+7iYs1bx5cF7QDNABnX/U0jhOxFUK3Rz+bH:RY1OcbIrRxUCQRWABnX/UhXx3J+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916697, "uuid": "c4dd4374-5ca6-4039-811a-7cd31dbff508", "value": 10923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916697, "uuid": "7c752c44-776d-4293-88cf-6c8db5e7be17", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916697, "uuid": "4d264833-6330-4fae-ada5-7007d5cb604e", "value": "Documento_6789789_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3400b3df-111a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771893966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893966, "uuid": "50c5c8da-cacd-45ee-8bba-00e2bc3f6255", "comment": "Malware payload", "value": "4b2869f7945e4061f193c179dec60c91", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893966, "uuid": "21a757e5-29c3-450d-a1bc-6ee9a06f9493", "comment": "Malware payload", "value": "c8ca2bff6ad5405c327fdcf8333119711a63068e42a03a37cc4927c71fe7364d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893966, "uuid": "46436a88-0517-4091-a917-4583375f009d", "comment": "Malware payload", "value": "5f24c83775f874baf3d659c316ed1ad83800a475", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771893966, "uuid": "7cb2122e-1ec5-4116-9e54-3e1459bd44cb", "comment": "Malware payload", "value": "b35a4c8943c3a01fb062168f115564c2c687b88e282ca6c291414f8a5d9cf61d38c656aa158241686f7ddcdd24e52187", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893966, "uuid": "0a9550ae-4911-4074-ae85-624ff5f5808a", "value": "T13B8412213708C1AAD3439CBD5BC6C4DF9658BC52DF1B66077AFAB70E7436207019A72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893966, "uuid": "bbe20d29-de03-43fb-a68b-c0d65aa2e782", "value": "6144:9NCsb8uYomWIpdPL0f2YLV7IY43fQzQsmJjQmyFgKJGoxFro0wDf4Rfy0:9NCpuVEP22AIj3f3sAjQdFgWcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771893966, "uuid": "6130a362-868f-48eb-99eb-df75d95afa7c", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771893966, "uuid": "5d25ca43-473d-4bb9-830a-ac3f9c976ef4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771893966, "uuid": "aef86621-9e72-4160-9202-6b86b64096ae", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.11219.4874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0a6233-1142-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771911371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771911371, "uuid": "7e041e99-2ce2-44c1-893a-c6ca2d57ff01", "comment": "Malware payload (AsyncRAT)", "value": "f03e08f20c15e3c554ed36b6f79346e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771911371, "uuid": "d360ffee-752c-442f-8167-50ce9d9f65fd", "comment": "Malware payload (AsyncRAT)", "value": "c93c47b735211f8c92ec53734d105b7dc41026fa77eb38dd778b5e6517e55878", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771911371, "uuid": "5d29f1a8-8239-4612-80da-71ee16954e3b", "comment": "Malware payload (AsyncRAT)", "value": "2615e15364e34abb2653132138602f4d86bdc71e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771911371, "uuid": "ee237d14-6257-4ac9-acd2-dc2939ca7b88", "comment": "Malware payload (AsyncRAT)", "value": "5d5b79c50cdcaf33617b6fb48cce2481bb4ab9c233f85b6e6448f50fb102f02f62dfff4dec76b109cf67650646e96ad5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771911371, "uuid": "f973ece2-8297-43fa-afcc-fde4f7322087", "value": "T1B8D23A08B3D88561E1FD56B94D7293048771EA5BA973DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771911371, "uuid": "9e6981ae-ee0a-433f-a9ea-7383ae15f2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771911371, "uuid": "52a9b5e1-ea5e-4bc4-9eb1-7c29a2ca6af3", "value": "768:2meRXjbRNsAUgg/cIRGqom/Rb7fB/dTb/+:beRXj1NsAU51i4RbN/x/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771911371, "uuid": "0a1a7961-0297-41d8-93f3-4aef4748f675", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771911371, "uuid": "6f727288-d0e2-4c1e-bf64-b0b268abad80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771911371, "uuid": "f9393cf6-759d-4605-a936-6e9e443db8dd", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52a722a-118c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771943226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943226, "uuid": "f9fd53b8-4bb0-4ffc-a168-dd7c3edbe124", "comment": "Malware payload", "value": "893e3f270dde883ed04e9fb3d408b9c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943226, "uuid": "4167cdfb-cc09-4988-9ba6-a83152e8831a", "comment": "Malware payload", "value": "c9a7c7059b08f1d4b4bf48feec48948f9d26385cdb62960147f34fd353d67814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943226, "uuid": "51d55318-443f-4079-849c-e0386e8a0dc0", "comment": "Malware payload", "value": "448a6195ea25b17c85444c56aad50fc3143f6a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943226, "uuid": "199a3197-640b-424c-977f-fbc234b71c9b", "comment": "Malware payload", "value": "5cdcf4902500a61ac6776517eefabebe970a639cdeeaafcda9827bfb80a02cb923a544e8bcf4fda19a76c7a9b7454e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943226, "uuid": "bd5375aa-f4ff-4178-b976-4b8cf95e3b52", "value": "T11755FDB45AE04135EF6325232533356F83AD3D48B66B5D32A6C7E0D6BE9CCF0098A359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943226, "uuid": "2dbeb2c1-51b8-4e3c-93f6-9fd2c3403d98", "value": "384:kw5ZrTclyuQWafuSPyxT4Q1lSMSpXddpnYu6LR12E5ODgaUEQu4ygzXiTFRiy2lA:mWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943226, "uuid": "6e17a6de-044d-4bc0-bb2a-70b6ba367b0d", "value": 1314823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943226, "uuid": "018bdd13-2952-46eb-bd4a-24d34f4f9cfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943226, "uuid": "22809f7a-2eab-417c-8633-5f92fdc76383", "value": "Swift-03112025_xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826d9345-1183-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771939195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939195, "uuid": "b0329785-800a-4072-a358-728884627412", "comment": "Malware payload (Mirai)", "value": "041a22af1c676d00b705f085384f19ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939195, "uuid": "f2e9b0d5-3bdc-4bad-9468-c3c5955e7e0d", "comment": "Malware payload (Mirai)", "value": "c9dbd28245f451cb64259dad997e40c8a0cc57039af503711848d7078d805675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939195, "uuid": "d83a0b26-ec44-457e-af9a-258ae8597566", "comment": "Malware payload (Mirai)", "value": "7e94094e4fef52bc24b73935dd6fe5fb37ff129f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771939195, "uuid": "ad2f6df9-cde6-4af1-8083-15a18bc57716", "comment": "Malware payload (Mirai)", "value": "ca97f4b1f8ff6b6023821228ec7dfd8fae9f4e75b817c65be28b142e421f86019b4099005b7ef9af789cc7be5c1b0602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939195, "uuid": "b0b16b0d-d0f1-49fe-8993-d44847b48601", "value": "T18C93D551BC82562BC5E023BAA67E668D336473E4D2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939195, "uuid": "187f1b38-6a3e-4a50-bd72-fe7e26ac13e6", "value": "1536:cd+6IHbLrKZe7C6a4m2qiLM3ZO+XC2zsethxAqrr8zQ:2+6cLrGoL+DhxA++Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771939195, "uuid": "edfaef06-5f2b-435f-953a-d08adf3e4a05", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771939195, "uuid": "e0b3139a-9c33-4b77-a6cf-83872721516f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771939195, "uuid": "6a8fe269-2edb-4fd2-a47c-ff04a8a60912", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b5833-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937643, "uuid": "9cdae1de-a8b3-4656-865a-c2543b07d167", "comment": "Malware payload (Mirai)", "value": "928a35079d7cf47142d77038423c8074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937643, "uuid": "f1675f0d-ffc8-4721-bfa3-0d1182006ed5", "comment": "Malware payload (Mirai)", "value": "c9e6a1d2103eb04222a6d33de58a6e47a1a886b4a46545efa5bb6b25673edeb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937643, "uuid": "94f04c63-d788-4c17-9e58-3a65b124d2e3", "comment": "Malware payload (Mirai)", "value": "5440456ddf25c55468cc7358a1904414bb63073d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937643, "uuid": "2d1b670e-bdaa-47a7-9c77-9aefd6a14b72", "comment": "Malware payload (Mirai)", "value": "2279aebd86917ff692822d87dfe79ee7bc48693064c1c7d94f998bc096dcbf5ca97ed15302d369598f2837f87e48cfdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937643, "uuid": "881d7814-bbe2-40c0-829c-acd390adbce1", "value": "T144057B237B31CFA5D365D27049F3C7519AD520A21EE24486A37CC3283E60A6D6E5FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937643, "uuid": "c63cdf3e-ec0b-45be-9ed3-54d700720cf3", "value": "24576:GXpbKbeS4IRH+BDt1LvYiT64XfVS88OHwc:+S4IRH+D6efVS8Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937643, "uuid": "d52c7f55-638a-4ce6-be53-e4778ed6c9a4", "value": 837240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937643, "uuid": "70e0221c-8718-4e3e-84e1-157a481cc3c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937643, "uuid": "d22bc6f0-6756-43d4-8deb-9d396e577f7f", "value": "a2work_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416a5a32-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919329, "uuid": "e26b3541-6f5e-47ba-9140-0d6aa36fab78", "comment": "Malware payload", "value": "a880ac70e9116d031bdf5728ac600608", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919329, "uuid": "9813beae-1fc2-40f2-bfd3-171b0206ef43", "comment": "Malware payload", "value": "cb8798d15fbb78b22794bafb2d7dc517c5d778a299c788ac8ae773d758895449", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919329, "uuid": "b0028b8a-fff8-4cad-b725-39067334c415", "comment": "Malware payload", "value": "8d44a792182de9f33f4e2312843394cbc0d2d908", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919329, "uuid": "65cb17d4-82af-4bc0-afad-143d309ce6fa", "comment": "Malware payload", "value": "fe5a1c50decbcabd8015d1059cb9293ff076f50596d607e712f6fc35acc27c8690bc7861b3f09e8a505e1c4b38c64dc2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919329, "uuid": "dfac1d36-18f8-4f28-9ce0-1237eef877d5", "value": "T17FD3FA433B290BCE7D6C205A92AF393893F874A06EE64E17FF655D20DD50DE381918E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919329, "uuid": "44d27e85-e649-485e-9750-1d535af4fe0d", "value": "3072:CPXZ7YnBeQbxZxVS3uF4Dgavhw+YbStGyZySZVCLNoI5BB6HLxY3TMr2U3TE67bv:EnspPX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919329, "uuid": "71ee2e93-23ca-4647-be6c-6fae8acb8d10", "value": 138980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919329, "uuid": "5bb1fcf8-1721-41fc-a08b-4b013c6bc84e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919329, "uuid": "a195f81f-4630-4ff6-ad6b-040b5d97a61e", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf2ed62-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917496, "uuid": "d563c056-48d7-43f1-9813-5e157fec882f", "comment": "Malware payload", "value": "dbbd9b3c9a670a50442ed0a9b73ef138", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917496, "uuid": "bfa30fde-469d-4118-8c8a-6c6846ff348a", "comment": "Malware payload", "value": "cba1ae503359c6dc669d262cf385ad0b7dfe370b9c40393f3d5e93ae2e2b0002", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917496, "uuid": "5bd13748-0768-42dd-a3a7-54aa08280dbc", "comment": "Malware payload", "value": "93ddf34f8ba34efc1ee3a33b5ba27def7efe3fa8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917496, "uuid": "cf57d4cc-a00e-4201-b847-b47a4f4ad3bb", "comment": "Malware payload", "value": "7a53f82081932c679fb990367ec69ca08e9ea1e1578b58d8e3070354ed891c77528ed5a713aaf01494cc5930f2ae0a0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917496, "uuid": "60b33bb0-eda6-4cd4-9410-6b855e6eadac", "value": "T115D3085E0E82489728A577566BB35E13D4CC3CEC12F2588315A1AA48137DB9B23F78F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917496, "uuid": "f8dcb67e-bb07-491b-93a9-5061a45c1ee4", "value": "768:C8m/Z6sZjWsYuSwnckNuR4p6Dz24FNVxeLScFYHXwz04mYF6F2r:CPXZ6uSEY4poFP4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917496, "uuid": "e722bc3f-7e52-4f9c-a8e0-10e3e0716a41", "value": 136117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917496, "uuid": "5d52e643-76c8-4feb-9256-2ae75972a277", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917496, "uuid": "56b3a750-5fdb-47ce-9f61-281fa77f1e1a", "value": "invoice-1645080830.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1b3d15-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947368, "uuid": "4b2745e1-d078-4354-875a-3ea3516fd839", "comment": "Malware payload (AgentTesla)", "value": "f29fcbeb0abd59d6f1918fff6efa9896", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947368, "uuid": "e62ee81c-7ac3-4cf7-9bef-1ba94c23b251", "comment": "Malware payload (AgentTesla)", "value": "cc60cf7faa4ec9da5a40aaa3593d41ef91097abeb373bacc9cf4c11b324cbdd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947368, "uuid": "353ac592-375a-4f50-b2c4-6e820335d080", "comment": "Malware payload (AgentTesla)", "value": "d4eec12fc8374a4e4239254b4e9be548832cce12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947368, "uuid": "18649421-03c0-4e58-8448-25a3f0bdafb4", "comment": "Malware payload (AgentTesla)", "value": "76ada6b3119707f38a17cdc78ea119a65e3d5b16dfdb6b2e1df268150aefe61afb539eef83150dd00784ae6df75004b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947368, "uuid": "305adb6e-e0aa-4d17-9ea6-27a7617ecf76", "value": "T1A445338DFF4AD0508DB3148359952A7CF16EFC4A2783D826707DDB732E612A12698367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947368, "uuid": "8740d579-1ee5-44a3-b80c-37e5fe77fe41", "value": "24576:FLjn8NfYDPLhbKeIz2exIoGgf7As8LCFGlqSMY7QRTJEkBJ9iTkgx+11h:FLj8NABITIoGg0salqSMKQlhWQgx0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947368, "uuid": "85c0f54c-beba-4564-8a54-c8741930a7fc", "value": 1187713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947368, "uuid": "3e3f0fc9-4389-4b53-b39b-aadff611e101", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947368, "uuid": "bfe2028b-7b3e-40a5-9f2e-90061644624c", "value": "23022026_1545_23022026_P05996J6GHGNGBGHF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4491f370-1182-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771938661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938661, "uuid": "bc378a79-5ca5-4a5a-b885-d386209178e0", "comment": "Malware payload", "value": "76635da26ec7060b26b52b0f98864aca", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938661, "uuid": "73e2cd33-bad5-4808-a705-e0e93658fc7a", "comment": "Malware payload", "value": "ccaac1459e8ce7963b4d58c91a4e5a11ffae2d4fe438ff58ff65a819250a17cf", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938661, "uuid": "33eb19f1-3d54-41a9-8189-db5af7265a60", "comment": "Malware payload", "value": "4b6e1d355c0cc5c7b48ccb888f0d5846f8460d0d", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771938661, "uuid": "4eb7dc6c-a643-4f0e-97d2-ce581aa16a8c", "comment": "Malware payload", "value": "bc7239dd4b190cf7766be59502300d149a2062f40de431713a88f253c17dd49fbf156f5c31fb770c75e6791f56faedad", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938661, "uuid": "f2378db6-3983-4fcd-a6e6-94b4a33d0669", "value": "T112014E427C24C56850D07283645DC99C46F6E11668A4F3E354C0FFAA45B27748D6F5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938661, "uuid": "7a8c6544-1679-41ba-a755-0d5e297f5493", "value": "12:5VWYYrw6KNkIMdO7YJXpf2JLuVHLCclDHNiTDkxLnVRH9HQCclDH9H+iTzYMeq:CbjGkLO7Yf2RuVHOclDHNiXwnVRH9jcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771938661, "uuid": "d87b3b3a-d63d-41fb-8df4-82db96ad6ac6", "value": 665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771938661, "uuid": "b0f5334b-ca98-4f45-9506-f1e1a07374e5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771938661, "uuid": "d1ef6f75-e321-465c-b118-ff664a199082", "value": "PhF19.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d862fbe-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917604, "uuid": "8c1068b1-462b-4b03-8eda-71c97d8c8d60", "comment": "Malware payload", "value": "1715c8924a78352e8afa1229fb9c8b0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917604, "uuid": "c24b7c9e-8021-41d5-a829-0cdd26af2335", "comment": "Malware payload", "value": "cd70a5262f0fa8725eb0e8f3c89023fb228debf6c5c92079462fa811da11c52a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917604, "uuid": "296a2c27-aa29-4913-afd9-c524f4b9f8be", "comment": "Malware payload", "value": "50a3e00f1dd2f05c3de45d3ff93bccc2e966b991", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917604, "uuid": "7f8358a5-731a-4963-bff2-27f1f25c211f", "comment": "Malware payload", "value": "52c98ac2cbb2241630d8dde826436dcb6cb2192c3ee024bcebebbcfcc408a1faa9d0feefc6306faeee51c5132a4089da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917604, "uuid": "247e8519-1c3f-42fc-8920-600112cb6b05", "value": "T187D308758F9592968A00E52D6233CCD22CF32D73E98095FB73D48EFB2916E112DD64CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917604, "uuid": "299913af-dd14-4b7f-8085-4d8f764c6782", "value": "1536:CPXZ6uSEY6ThkOJWFL8fwF/FvpbLk/Y7q/7cBvJWcEZlONSpbKCay7JyOra/O4zK:CPXZ7YnZpt4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917604, "uuid": "bc63d339-f5e1-467d-ab88-8d5e14c3d598", "value": 141865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917604, "uuid": "50135a4d-3a31-4ed1-8d71-400fd61b552e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917604, "uuid": "2218ec46-bb09-47c0-9f87-f664eca58bb3", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2daa3c6a-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919296, "uuid": "7c4ac430-b82a-459c-b960-4c25d316c3b9", "comment": "Malware payload", "value": "f3a6b67d2dcd6d26fd8a49ba15297278", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919296, "uuid": "ec020310-899c-4fbf-b2d5-e40b8376bf49", "comment": "Malware payload", "value": "cdc16c537db8f7b12aceccf45109645bbabeadc3bbf568297e31b03d91408a7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919296, "uuid": "3d974d19-2e4d-44fd-904e-363f70b6e486", "comment": "Malware payload", "value": "1830b54edfac68614b83903dc3e4e7075c9582f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919296, "uuid": "2e17d689-98be-4647-8aa5-5a57d1de4102", "comment": "Malware payload", "value": "168322d279d99166f17a24b66e87e590913c58427a60009cca4f4e97d9e404ead4b20285c446be5b22c7c40810576654", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919296, "uuid": "1b79d127-1438-46ce-916c-651bda866b83", "value": "T1A0D3C6CC5847EAC5421B42EBCC3C03BD6A5A1A1F86988697CC75C854E6ED763CCB636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919296, "uuid": "7fcad0b2-27f7-45bf-adab-d2179c3460bc", "value": "1536:CPXZ6uSEYgZJAuMSY8cHPVPXNopjC1/3w6sOlUudGXdJiYKDF1GcQJNJQ10XNNiT:CPXZ7Y5UpD4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919296, "uuid": "8bc99319-9572-4028-b8a3-8b1432cc1c25", "value": 137015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919296, "uuid": "31b4e7b5-2baf-4ae1-84ff-074ef4c6ed82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919296, "uuid": "8341c787-96dc-42cb-ad4f-6ffb57a505f5", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd1ff2c-1121-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896935, "uuid": "4570592c-f430-4c4a-a0f3-8bfe0332c327", "comment": "Malware payload (Mirai)", "value": "30a82da4c76e4cb6f9b5c866ad1b2fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896935, "uuid": "daad2f7e-60de-453b-adfb-a0b5b3374790", "comment": "Malware payload (Mirai)", "value": "cebcfd41d124fb993936a4f9687a34fef3e21f60887c8404489d38b94f096a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896935, "uuid": "284e504e-228e-41c6-86c6-70abc954065c", "comment": "Malware payload (Mirai)", "value": "22355db4ae1c38bbf780393c1905f2bc76a4c3b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896935, "uuid": "31d76c1b-24e4-4e12-a213-eaa50b7b2fc6", "comment": "Malware payload (Mirai)", "value": "8298b8e67212eec57475a0c1eeae94211b9590e40c094def943b4453a72d88117ce83cf1fb502b4af6c370f31624eaf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896935, "uuid": "02f9065b-b57f-4735-ab25-6b805a7b9725", "value": "T1C2C3C91E6E219F7DF7A9823047F74E21975833C627E1D585E2BCD2102E6124E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896935, "uuid": "5ab4325a-c44f-4297-95a0-c9984d952c0e", "value": "1536:NKf9XrD10BOWgmgIqQTuvL3V/R6MoZLU56WTXI8vU06iBeh1Yvg99hB:07uBbgUMoq56WTXm06ipg99hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896935, "uuid": "c789c92a-eb63-4ad3-b601-aef21884e8c6", "value": 122272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896935, "uuid": "eceb41f6-423a-49db-ae10-78b96c7745f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896935, "uuid": "dbdcdb61-188d-4be5-b84a-19888b2e1a92", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092c5814-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771957030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957030, "uuid": "1ac99e34-3b6c-47b1-813d-b33250ef88d2", "comment": "Malware payload (njrat)", "value": "ca677587434b6362bf4c3273a346ae08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957030, "uuid": "99f108bd-d764-44fc-9a0d-577bfd3f1eb4", "comment": "Malware payload (njrat)", "value": "cf0faf746648fb805435229dc101c575e3d6973429c427d663c6113c41f2137e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957030, "uuid": "8d761fe0-f966-4d24-9cc0-6be908248bf7", "comment": "Malware payload (njrat)", "value": "94fa3ea8f8a0fea63307fc91cec9e2f76a54eb05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957030, "uuid": "a6fc4437-a7cd-4d60-a6b9-a682c0408f04", "comment": "Malware payload (njrat)", "value": "b2d92e50f672847d5945342ac7e072165b9cb868e3c32877e3c8d6d1757006a1caf7f915695f2d01e7c11e7edf0774d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957030, "uuid": "eba3abeb-5e46-48c0-9183-69da75b0f129", "value": "T113C3160EB751CF98C05D0E7789A346F502B9CCB66927FBFB59C43DA0E825B98CA4A540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957030, "uuid": "14b08ba4-e0de-43fd-9818-48d1680b6ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957030, "uuid": "445b5613-8f2f-44e5-a8c6-1c4a149fca3d", "value": "1536:MFxekD0LxBrm3N8Jhtzx4+TEcLeIHpls3KJ1clPQBAfirUVw2Djs0uDbm4juCCZK:VVvoK2+TESvzc13nvjADbm4j269r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957030, "uuid": "ee4466e2-650c-40ef-8480-b683de811eba", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957030, "uuid": "966f4a1f-bb9e-448d-964f-1536305ba42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957030, "uuid": "422e558f-6af1-463d-ab7a-d6d163cd3452", "value": "optimizator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2519c1-11ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771957059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957059, "uuid": "efa82af8-5270-4c36-bf62-e9e988cc9dbc", "comment": "Malware payload (AsyncRAT)", "value": "5a35d28c5febc99a2d38967dbe657585", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957059, "uuid": "92456367-a88c-4491-8ea9-1c7b0b35f347", "comment": "Malware payload (AsyncRAT)", "value": "cfbbd1f57120a41c73761d191505fc97256c7839ecb828369cd4f69919bf64aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957059, "uuid": "41230c1a-611a-44e1-9484-dcee94a93782", "comment": "Malware payload (AsyncRAT)", "value": "68365b927e7545ac22add086394b514f16bbbe84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957059, "uuid": "0f7d31d7-2d44-4ead-9751-e21412da1420", "comment": "Malware payload (AsyncRAT)", "value": "cac46e3f50e74b9a98f7d2e355faa414bda30aceee29aaed1822749781645aaa23a8e13cac1b96fd0ec1118ccf53a20f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957059, "uuid": "12dfcf12-6382-46d0-ba70-d9a955eeaa11", "value": "T1E7E23C4877E04312D9FEAFF02DF2710A5274E11B9D23EF5E0CD4899A2B679C246507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957059, "uuid": "c8343117-8fbd-4ed2-9136-02a3e4f80a8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957059, "uuid": "c737420e-8b88-42c7-8bbe-9696ee183638", "value": "768:C0dT+x9p94IvGFbO75SCVFo9jPOjhAbc:BT+xt4I+bO75SYFo9jPOj+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957059, "uuid": "7d5c56a5-919f-4c56-9749-626fdeee3f1c", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957059, "uuid": "47370206-ccf4-4a00-bbc9-7c9bd1d8d179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957059, "uuid": "252ccd13-4097-4153-9bd9-4af2d71882d1", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a33ab4a-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917572, "uuid": "c5db567b-71e8-48d9-968e-0d0bf98db48c", "comment": "Malware payload", "value": "11d51348468ca52c10f883e9fd311d9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917572, "uuid": "5f2102a7-3ccc-4946-a3b4-533da98e657f", "comment": "Malware payload", "value": "d002945b1db9003a5c65d7534a6462f7a7487ebf967e7ae174761df4adcfecdb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917572, "uuid": "d2fe35c9-50df-41d9-8b40-14dbd4de790c", "comment": "Malware payload", "value": "70ec2f6892d7a4b9d2dff60394c1b282ca65c0f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917572, "uuid": "8b8f90b1-34a6-49ac-9f50-dff64d73626c", "comment": "Malware payload", "value": "c34b5c198c81c24d6608f14267446b51d39d77be1341b0a8795f475520e1751e053b803a916c929ca5213ae99f6315d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917572, "uuid": "b6a78e63-a13d-41c0-8c9a-4ea694508a71", "value": "T141D3E7946B875EFA53EE2507618FE33CECB081327C529DC5550AFCC5EB99947BE008A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917572, "uuid": "3315560d-afea-4b4f-aa16-3c481f2c4d07", "value": "1536:CPXZ6uSEYdGS1jLqgFQ9Fnbm9b+syBj3qNZqeAaspr3F1sA4nl5+omaBsr2mjaBG:CPXZ7YQpTk4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917572, "uuid": "b97c129d-d8a0-4a82-b4ca-778433b3f05f", "value": 140914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917572, "uuid": "9772bb1f-2bcd-4861-a9aa-fe0eb11ee12a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917572, "uuid": "1b8b1406-a612-49da-89b2-f8271d3b920c", "value": "invoice-1645080830.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c93cf6-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917380, "uuid": "bada27f9-c031-46d0-b1c4-c8ac000a0a58", "comment": "Malware payload", "value": "a6cacdad3f7690621c2b19b986f072fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917380, "uuid": "5cf0ddc3-2edc-4c24-96c7-58ee9ef98cf3", "comment": "Malware payload", "value": "d0851e1c020a936b7361cc83b83da73523c220fffb639495318d9047a49acd4f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917380, "uuid": "34a21a82-391d-4039-b2b1-4a057e32ed71", "comment": "Malware payload", "value": "8ecb099a557dd401fb991294bf508f8e6d1ff1ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917380, "uuid": "e31d6204-b4c1-46e2-a6c2-f850989f3399", "comment": "Malware payload", "value": "64e38c0c1c8a18383e77e8045a497a286d1ead34d211fef98518bc629040b13220ebd5f0a0edb3ff78e151a77f62e4a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917380, "uuid": "6e08f587-e31a-4796-8a89-6bb80189c041", "value": "T1CBD3E8EF26C88F3A33BFB9B5617E32751D959B225E4770478806AC1D1A06FC2E0571E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917380, "uuid": "597aac15-ccbc-4ef6-9cdd-24de4f2acb98", "value": "768:C8m/Z6sZjWsYuSwnckNuRWrFqp2jMEGwxeLScFYHXwz04mYF6F2r:CPXZ6uSEYqFqpXw4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917380, "uuid": "eef4ad32-4fd8-4998-82df-f8be8d304d00", "value": 139880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917380, "uuid": "4fe752a1-2085-4960-ba9c-b44ab78065b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917380, "uuid": "2de87325-8aa9-41ea-8250-55c23535bf08", "value": "invoice-1645080830.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f6ca0c-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919472, "uuid": "0086c0ba-715e-4933-8caf-c9c4c92e25f6", "comment": "Malware payload", "value": "be728e3d5cee433708bf59e811f003d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919472, "uuid": "6258d2b2-19c7-4406-a741-8a88ddeba794", "comment": "Malware payload", "value": "d0d930f5dca93f1724c7774da89b1e7e492c43ed6a927c0772d632543a96d650", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919472, "uuid": "9168a9f0-ee79-40d3-8d7e-5f1e226e89be", "comment": "Malware payload", "value": "5a681d3b62eae48f1e3debbd14f7eae1209c8ffe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919472, "uuid": "24370917-0984-4a11-bd64-1ac4ad6e536c", "comment": "Malware payload", "value": "0d794bc93b20c0649ead3e0e2e4326b82a332953edbab51e1b6df73f26eb1831967c19fe424ebe21b98e8815a69fad13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919472, "uuid": "5daa518b-128c-4d65-ac77-14045bb145ff", "value": "T156D3CA6759114F1EF0C6C2FF807ECA669BB546C29E39C9CA85AB6C08ED15850F2EF0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919472, "uuid": "d5a7759d-4138-440e-b298-d67131bf07a2", "value": "768:C8m/Z6sZjWsYuSwnckNuRr5+5qFapD5ng5Ng5E5X5x5u5G5h5D5W5X5N5w525R5C:CPXZ6uSEY3Faph4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919472, "uuid": "def85dd4-ea75-4f86-a819-568f669bcc77", "value": 137018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919472, "uuid": "df3fcdaa-3726-4220-9fe7-2914cbc298a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919472, "uuid": "1d7d0724-1130-4962-8bf0-9d2f6a7b173f", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f192f43-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917553, "uuid": "033cbb69-bdfe-470e-acaf-97fe03c9a660", "comment": "Malware payload", "value": "70ed7d2470dff0dadd66cb0229b6a9c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917553, "uuid": "25cc2741-4b84-42ce-8f80-4fa60e7983a5", "comment": "Malware payload", "value": "d1067e92dc4a0386f619f6c0dca630888ab48c3e842cc0cc4d524095b76c072f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917553, "uuid": "dbcf3d53-f9b1-4f23-85b8-9b42e4fc1ae1", "comment": "Malware payload", "value": "890332b39522affd1a810961681e6ea4b2f0f536", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917553, "uuid": "3f325479-e77c-4a1e-b20d-48869cfb9ae1", "comment": "Malware payload", "value": "f4fd0cc9a2d7ede8a985c4cd6309d6fa9d31aa28ddf1ca0e33435b333a4beb7aa8c5012236ec5af29ee120c1981f28c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917553, "uuid": "bd3065d9-1972-47ba-bce4-9115937148e2", "value": "T1FFE3FAEE5422D9E9ED9E64E1C531292F40FD4DC30A697350DD383A56EB07B6A310FA23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917553, "uuid": "71f7873d-b014-4f00-9037-1db93bdba7e3", "value": "768:C8m/Z6sZjWsYuSwnckNuR2X+FNpEQI6/xeLScFYHXwz04mYF6F2r:CPXZ6uSEYo+FNpv4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917553, "uuid": "b92ddfdb-cc76-4109-8352-278f4e473c16", "value": 143765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917553, "uuid": "7899401c-ee4e-48e4-a34c-1dd9bb0d361d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917553, "uuid": "947479d1-5dec-4d58-879d-3e712549c3c6", "value": "invoice-1645080830.pdf (68).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236d99a3-114f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771916701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916701, "uuid": "14354b8a-d794-418d-ab05-ba1deab20665", "comment": "Malware payload (XWorm)", "value": "f2e349743d0cc29e7294298657c860c2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916701, "uuid": "0f439540-8d46-4a07-b648-df6c6f1b5256", "comment": "Malware payload (XWorm)", "value": "d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916701, "uuid": "e0bd7b1d-cef4-43e4-b570-c2bb3fa8d2b3", "comment": "Malware payload (XWorm)", "value": "18734b01dd0491008bf12ee2f4536f79b78a53e0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916701, "uuid": "ca6adca1-d95e-47d1-bfa8-262a09d3df16", "comment": "Malware payload (XWorm)", "value": "e244511028caacbb7dd750f868bc592a04969a100e67e58a9ce55c970e6b6c61b9a8fda4b36544e0803422fd6f7831a0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916701, "uuid": "6bdfddd6-0230-4b3b-9f52-7f40026bd405", "value": "T16812AEF5B028EAC3F93BA994BD122707FF50EDAB494076F26929A64F2E00480461F479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916701, "uuid": "23fb393c-6ff0-472a-8372-a64f38913989", "value": "192:4b4Q6BOmCfc4YZczMh1tBi0Q625K2KmWObc68+1gFAPqbZm9mZ8n/j:Er6wmCpZgPBT25K2YObcfYGADIZWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916701, "uuid": "84c89bda-6ab6-4a4e-92c9-ca3ac53ce398", "value": 9569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916701, "uuid": "99cd83aa-af9a-46e4-bc50-5b64dfd113b4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916701, "uuid": "2ed741b2-c813-4093-8d6e-8f5064fb10ef", "value": "documento_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5435463c-1123-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897885, "uuid": "ae1cb513-5a47-4dd7-8c50-0e638d799b95", "comment": "Malware payload (Mirai)", "value": "7b063816a463bcb87d74f8be1ab12744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897885, "uuid": "9279e0cb-af56-4aad-be96-fa99ab929a91", "comment": "Malware payload (Mirai)", "value": "d264f20ab53dfbc2d088af7144d73b2f4e96476bc6c1cb9a97e4ee97c9cbfe35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897885, "uuid": "e9a65751-9c5e-4d31-b7be-f7937665a008", "comment": "Malware payload (Mirai)", "value": "e05ce89590bb8c102ea7d02a47b6705f0a8c26be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897885, "uuid": "784d408d-1fc7-4d5e-9053-8d93dd7997a6", "comment": "Malware payload (Mirai)", "value": "67fca51bd88b6ed62c2c871e1dd7b4b9f7148335057e26210ef78cb9e664888857dc9eb9c8ce56fc9a24a79279a2b4fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897885, "uuid": "02f800d2-985b-43a6-8475-6fc4e062ebe9", "value": "T1B8631238621A7532DE406B72C0FDC6C5824C4EB835BE5358AEA10D78CDEA2276C6575B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897885, "uuid": "e5089814-f98a-4882-9b26-cb090c8fd215", "value": "1536:yWMveaXjLbdMq7IlPjHneJnMLAc0EaHQJWhNH:yWMXXjD7ojHeJMLHaHQaNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897885, "uuid": "1d2b0b9a-9dd7-4d47-9bc7-ffbfacc40267", "value": 69064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897885, "uuid": "2e053264-d703-4749-9dff-99e89d20aedd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897885, "uuid": "9c139000-4d5f-484a-87da-c50b09f2c60e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126a4bbb-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771963059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963059, "uuid": "7e6da09f-9260-42ba-aec1-a4dc1da15557", "comment": "Malware payload (Mirai)", "value": "c41bd5ba20305717d8bd02232de50eaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963059, "uuid": "ded6a67f-a987-4727-91e7-0107132c6812", "comment": "Malware payload (Mirai)", "value": "d27f1215ed03807a897ce323d19e3350e1374100a5d8022b0e267f01b35e98a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963059, "uuid": "d8f710ef-a922-4cd8-b5fa-b76ebb41cac1", "comment": "Malware payload (Mirai)", "value": "f737e9684dd157e37914bdbc918bb6bb71c68da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963059, "uuid": "98f43905-710a-43ff-acdb-e7da9abf4a66", "comment": "Malware payload (Mirai)", "value": "8e16211c7cf6db4c274617609f978332c48d0a6f39d061316ccdff5aaf46d4ab9b0f34b80e4631935ceb763cc849a34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963059, "uuid": "bbcc9034-7f64-4e86-b8da-2a2c965d5bac", "value": "T108B31917F6D2CEF6C08352702ACF9AA25C23F5FC1762711733AC6DA42B1D58A2D99E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963059, "uuid": "e473124d-f5ea-478e-a1e0-5686642913b5", "value": "3072:YowlDZRxCi08JsPO1G9phaUeDCDOlOmnduJXLBYZGSKe:axCVf9phaUeDCDOQmnduJXLBYZGSKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963059, "uuid": "5c181f1d-66aa-481f-8101-f68c23dd58b9", "value": 112456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963059, "uuid": "8bbad14f-bab8-4174-b5db-a19e0df127cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963059, "uuid": "d70ee8b2-c167-43f4-bde0-f67126762c47", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30764b14-115a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771921448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921448, "uuid": "c83fb8b9-af61-40ce-9298-bcf74e59d210", "comment": "Malware payload (RemcosRAT)", "value": "fe393476c4ebd97628ea3099cd96f4b4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921448, "uuid": "0673f7e5-0149-4331-b7f7-dcef0cecf611", "comment": "Malware payload (RemcosRAT)", "value": "d309311805e7a32f37b82cf6acb6333f52d4c19f7c8f486982976af58b0ae498", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921448, "uuid": "0fec68df-3952-4006-b37a-424c989e5d48", "comment": "Malware payload (RemcosRAT)", "value": "fe27124ee4f034b97f8ba99b1de5be0baab002be", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921448, "uuid": "6b3649a6-b82c-4d8a-865a-ca78fbfa9fe3", "comment": "Malware payload (RemcosRAT)", "value": "5a0b18a832684f06a717eb33d9e1d30e75e4bc1619eafc38fc17ffa1d5bed3aaa423779f022cf5b88a102aa2143d591b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921448, "uuid": "9d0af37e-c93b-45d7-a652-9579197c9fd6", "value": "T176728229CD09DFF00A2D3251B56B682A69501366BA34390D7D8FD5ED3F7AA10CFD01EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921448, "uuid": "d7f7b4f1-4189-4aa7-8e55-1bc6b9484478", "value": "384:KEFdr6HX5yo3r/afSIZrgcmtil+cP5R4CoZfAecqHzZdqAEa:KEXr6py9qcELCcfRHiAEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921448, "uuid": "9c682478-cc18-4c8f-9fc4-8e598a101b08", "value": 16924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921448, "uuid": "7c8fa685-bea5-430a-9570-41f4075a11aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921448, "uuid": "a7c5d55e-b49a-4c3d-b2b8-bed2bbde087a", "value": "SOSTENER2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c95ec4-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771963061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963061, "uuid": "822ee37a-b2c6-4e8e-969f-86710a1bef74", "comment": "Malware payload (Mirai)", "value": "780994ae5c3bad92b9d258159ef9966c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963061, "uuid": "96d06003-021e-4e9e-9800-ebddf5a735fc", "comment": "Malware payload (Mirai)", "value": "d4040fa8647b5b90e1d3bfbdd35b2dfa15c55df6bd31aa6b23dac22f22fcaca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963061, "uuid": "eb23e42c-f44e-47d5-a4cc-355bbfe78ef2", "comment": "Malware payload (Mirai)", "value": "1a9e173e5621d4d9b27dc3c9a9a59903d9d400c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963061, "uuid": "83de34ac-17c0-4f3b-a89b-a6e967bcb70a", "comment": "Malware payload (Mirai)", "value": "cc5c1b8fdc18b932853cd9cd3cf5c080ea24b02b7859b0e7e9ff44c3bb18548a775b8d80fe38f5f3c2775578100b1857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963061, "uuid": "57575121-4ec9-424c-bd82-33d96710fc8a", "value": "T1AD142946EA414B13C0D627BAF6DF42453333A7A493E773069524AFB43F8679E4E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963061, "uuid": "f331139d-fb60-46a4-9f7f-ad8464cd8798", "value": "6144:/2C1Xi44/ZaLl5buuudnL9hOzRZM/R5pTERQ:+CL4/ZaB5buuubKRC/3pTEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963061, "uuid": "a68d8e57-e51b-42c6-b262-9e1001547c27", "value": 197961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963061, "uuid": "5f7ac196-29c8-4042-ad8f-3fc0471d2cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963061, "uuid": "257f4af9-b763-4930-8190-b49e9ae843df", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b76f5f4-115f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771923533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923533, "uuid": "dbb4c293-ff31-4c5d-a0b4-dc16baa1b491", "comment": "Malware payload (SantaStealer)", "value": "ba0d07e969215fac9c913be5aa676a95", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923533, "uuid": "8c52eaa0-fce9-4c66-8676-ae42bd6a5752", "comment": "Malware payload (SantaStealer)", "value": "d4cdbd3b915a09c1672272917e20e04596d91fe3738d0195ecb71ae770ce6def", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923533, "uuid": "d7740f99-41c4-4525-8555-2f62cd8da2e7", "comment": "Malware payload (SantaStealer)", "value": "db6ecf5f197f0d6d6672929028a4ae19b26fa7c9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923533, "uuid": "5746d142-e7b2-4240-a2fb-150f69af17d5", "comment": "Malware payload (SantaStealer)", "value": "660a5176e098086b4e24e7db92f0c263a49dcd6101d00e1927608c3d9d03e8e6f3bf889f978bd44c946eb656b0ad82dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923533, "uuid": "cc185a71-ced9-4228-a9ba-5b60412c4b29", "value": "T1E4E6490011D91657FCBADFBE99DD73450FBA72D93736EA658B0109ED0ED2B08C8439A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923533, "uuid": "7978419c-cf90-496a-b3e0-c0c2e6a16a9a", "value": "196608:dVGAN6lIfH2Ix3/WpNL/priILrrdKCqt3kgyUG7Yw8:SAN6EH5x3mNLJiqrsUZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771923533, "uuid": "27504519-ac9e-44e3-ae14-d8f628caf93a", "value": 14795776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771923533, "uuid": "068bf79d-cc50-4e57-8f8f-86bb0639af3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923533, "uuid": "91a6827d-5c2d-4850-a5b9-c1af58d656df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cea0fde-1158-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771920717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920717, "uuid": "52106690-529a-47a4-8410-403c58c5d786", "comment": "Malware payload (VIPKeylogger)", "value": "e4a48ed76d6975811de74c709c3a38b3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920717, "uuid": "12cf5ea7-099f-4cc9-ab80-e6053bd296ef", "comment": "Malware payload (VIPKeylogger)", "value": "d4f2c8d4ed30fe2b339671fbe2b551a6e7d2fdc7726e68f811c11392be2920da", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920717, "uuid": "c8ca2554-2c7a-4d28-abba-527f39d6e19c", "comment": "Malware payload (VIPKeylogger)", "value": "6f41e5eca15c281df4a44132a050ef139b78a38e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920717, "uuid": "1b556cdb-531d-42f2-97c4-722d7bcf5d2b", "comment": "Malware payload (VIPKeylogger)", "value": "03fd3ce666fb9bc1406f51c940b174042a44ee0bad7dd46ce0d3b9e9720b5df57576f3f14b330d368056dc384e0d4e0e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920717, "uuid": "71624cbb-bc2d-4944-b5fe-2d51af86c50f", "value": "T1DBF3F2118D881F59DFB4490940FE0AC7DBA4874B95A3584AEF237E0F7FEAA0416D21DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920717, "uuid": "a0237445-ddc5-45c9-a70e-7e3eb29d6a77", "value": "3072:unQOJtXSxwEwfacTMf7FshZ7GtrSlp0ag/AHL1rssnhRSILLsueoO:SQMXWwEwNMfChSrU+d4HlssrSILLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920717, "uuid": "b79d66cb-279f-420c-8100-d05824704cc4", "value": 171431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920717, "uuid": "0562ed9a-5acd-404e-ae43-74be7084832b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920717, "uuid": "1daa6f4c-2d16-424f-91e2-c5dddf91aedb", "value": "159714294_ISLENMISFATURALAR.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c827ad66-11d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771974101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974101, "uuid": "9feea97d-8c86-432d-a24b-b809ddba6cef", "comment": "Malware payload (Mirai)", "value": "3811f8f6fa2ca876a0b4a99ccd078e67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974101, "uuid": "6169a2aa-7005-413e-8269-38ba54b10313", "comment": "Malware payload (Mirai)", "value": "d50eda23772686babd4a703641e33db5373d13035290f8699644b6b218316b49", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974101, "uuid": "47a3b415-4c7a-42a1-af84-00e9afa30dd4", "comment": "Malware payload (Mirai)", "value": "e2036b4657004fbe793cfd5b811b402ac73ab597", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771974101, "uuid": "f9ed0c1a-471e-49b7-bf61-8a0358d2258b", "comment": "Malware payload (Mirai)", "value": "65e99357dab17563481754f0015950ea6d298726000b912fa2109f6425ef52da7f60fbb2e1000d3c5ca2fbe80a563b25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974101, "uuid": "7a6c4659-aa5d-4eed-af81-fbbfc4bb4253", "value": "T1EBC3AE83FA8714A1C46206F017C71BAD2F93A122CF5FE4E7AC1DA53B5A7A0DB15263D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974101, "uuid": "87038a55-0cb8-460f-a804-782199c6c39a", "value": "1536:ug1j3Xi2RAaOOgn1QKqMB1W5oP2zeYdl8PticFxs5GEg1JEt/LWT:99XfRAjQzM/M+yeYdaticygaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771974101, "uuid": "4103189e-8040-44b4-91a8-c0980eeb54e9", "value": 124680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771974101, "uuid": "c3722e8a-c316-4789-bfa5-940f63990690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771974101, "uuid": "2b161714-9ab3-4320-b76b-17e21ce609b5", "value": "ez_nigger.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b4669-11b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960353, "uuid": "87491305-87aa-4285-9bf3-2a2dcd0e8aba", "comment": "Malware payload", "value": "afe28bb9ef5f18731f07980ba7d81079", "object_relation": "md5", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960353, "uuid": "03688ae8-f1fc-47c7-844b-3ef6c902f702", "comment": "Malware payload", "value": "d5c58c2b16f61df23e4645b39bfd5c6db58208d20e113a2c917aca647186b5f6", "object_relation": "sha256", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960353, "uuid": "2ced8bc9-10c1-417a-aca7-34421d48c296", "comment": "Malware payload", "value": "64e0cf8abd9c88061eddcbcd6191a4b115872014", "object_relation": "sha1", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960353, "uuid": "f89d81ae-4dd5-41aa-9812-bd54799f5258", "comment": "Malware payload", "value": "50ae5ff19b5920fcbb644906ec30206a20cd4db49b52d7aa0ca1787a7f7c5dec3aff1a8c3617123854eff136150565ad", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "212-118-41-180", "colour": "#4BDB2B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960353, "uuid": "687c5d01-e225-4f47-92e3-a4f944034529", "value": "T1EF873361C9781DAF63443A279DD7D940951289F28515CEFBFBC8D3EC8BC0EE086719A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960353, "uuid": "4aaa45fc-ca1d-430c-906a-05c501cc0e75", "value": "786432:l8nJGpNbpQQhaS7sgnirqfzNH1j/68w61UCajMaaA7zm:l8kNtQQMS7sgjll1ajM87a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960353, "uuid": "b21ec493-3886-467d-8859-bb51f5eca520", "value": 39445648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960353, "uuid": "a4fdcda5-42fd-46c0-85c8-8aa5d633a847", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960353, "uuid": "87abea64-ed3c-482d-8386-4aea3d979fa8", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa6b725-11ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771957014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957014, "uuid": "261cad2c-6a80-4948-834d-2ee55f5f982f", "comment": "Malware payload", "value": "d222e318924cbbcb6425b3e9e742d250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957014, "uuid": "1f289ca3-3cb7-4e89-b365-dea1edece7be", "comment": "Malware payload", "value": "d5eba48f4dfa0140cd00a7c9f725189fd3c71d1b2137878d3d53374f7695ba29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957014, "uuid": "567b2ac3-eb14-4ee3-97f6-2928f7d805e5", "comment": "Malware payload", "value": "43c495b1c1d36b45fdd79b13fdacc436df067258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771957014, "uuid": "4997f2b3-b91f-40d9-979b-d648fd18d1e0", "comment": "Malware payload", "value": "8f86796d33097431cdabd2580f06689d6fab22c35d9d4639250d128c868d2db8f7ebd5b4d96689e0c8e10fe7f9f5cdf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957014, "uuid": "c2724b9a-5c20-48ad-a652-6a95741ed6d9", "value": "T1EDA4B60CFE91F845CE1A3EB7CFEA18109B7160C16E1192862155AFFD876A3735CA627C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957014, "uuid": "9c2228ce-59c0-43b8-b420-ff8499479f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957014, "uuid": "3028fff5-a8b7-489b-931e-5109f8368cdf", "value": "6144:MF+U2ZHQIooYtEgVszjZoSID+AMBOuu4amSkVrk580kbzvHFE4DzIJvR:MsJs6jCbZJ7B2rk5d0vj3CvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771957014, "uuid": "30472ff7-7eac-4ed9-b406-91c6ee4dd422", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771957014, "uuid": "bf9d31d1-fed8-405f-a825-24b8f030e9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771957014, "uuid": "0ecb34a4-d5e8-4c62-9e89-95b9b9c4353d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b30c15-118d-11f1-a769-42010a9c0008", "comment": "Malware payload (Melofee)", "timestamp": 1771943493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943493, "uuid": "80df8623-d238-4b2d-9d18-21932f6926db", "comment": "Malware payload (Melofee)", "value": "779f4dfdba4c24bd4a084d757b1039f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943493, "uuid": "77cbfa60-d64c-445f-a4be-05108dae0b47", "comment": "Malware payload (Melofee)", "value": "d67259690bd1440effa0e42ccb143055bdb3d4daf51db85b740449db1fd3c155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943493, "uuid": "df7b0fa4-94a1-4e04-99fc-67ac3902097b", "comment": "Malware payload (Melofee)", "value": "c68c54be53634c0d5334d8dd306e3d458481f2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771943493, "uuid": "669ea475-b7ba-4887-a669-ab6042b8485a", "comment": "Malware payload (Melofee)", "value": "97d6d261b6202e182b37c1378a8d8a68d519576a882f398d23c4bfeeada1dea5ddf74cb398228ad1a9ea9a25611cefd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943493, "uuid": "b69d10c4-ce3b-40df-ae09-834447512569", "value": "T1BA458E5AB2F374FDC067C030835BDB626835F46541326E7B71C4DA352EA2EA01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943493, "uuid": "9b94d117-b077-4163-b944-533efdc5a57f", "value": "12288:d810mRPhEIQYNLlml9rKD0nWxRdRa0u3smyJrTBwRPDw5khSgJ8CWh:dO0mRPhEIhRi9rKD0WxRI6hADLLJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771943493, "uuid": "92733358-12f0-42ba-b184-f978f55899f1", "value": 1173144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771943493, "uuid": "44bc75da-5101-4f40-aded-091e58cb0973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771943493, "uuid": "9de863e4-74b1-4df3-bcbd-a492b5de651b", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34797373-115a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771921455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921455, "uuid": "4e5be4ba-fc96-42ab-b5d2-ae9a1bccdd94", "comment": "Malware payload", "value": "28a6936859985ee3f33ecfae1ac5cb2c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921455, "uuid": "42612beb-d504-42a0-9f63-2054de293451", "comment": "Malware payload", "value": "d69108a94a9a81e07a05d456dc997cbf5b5a8cc8f0869eae7904fac1da60f335", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921455, "uuid": "a5b6bdce-6ba5-410f-8b5e-ca6cf6a02ea7", "comment": "Malware payload", "value": "249aea2c34148709378422601b4cc4c8e407e654", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921455, "uuid": "84af35e4-ccd9-4afa-a086-7df3206092ca", "comment": "Malware payload", "value": "7a284c84fe2cd8e11aad8d2d469b4c9531d013e9eca85fdd11b22877f61506388fc77d0e84f001e346fa59fd4bb4fd9b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921455, "uuid": "dbc4c2b2-7fa8-4cf0-bd76-360fe69c03df", "value": "T1B79633C6F764486FE8B349354CA54776172A9D46CA82670B24683B3C383B7C90FA9FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921455, "uuid": "6c2f4342-9ca7-4057-8275-af5ddf169c00", "value": "196608:KGIX3EITAC1VXyyQcrQhf7mv4ETcdUeeGq9QgUjpkfblpgoLyStnwC:KGqEI5Xx8hiv7TFee99QtjGfblpgoLyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921455, "uuid": "1085911e-49fd-4319-b94f-a33d9b2e35d3", "value": 9210113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921455, "uuid": "6f27652b-2688-400b-9cb7-a3f43b772fd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921455, "uuid": "4ffef876-88a7-4c8c-a88b-6213e4d18a30", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2195e0f-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919518, "uuid": "71332e62-13a5-41ae-af14-06b75347f97a", "comment": "Malware payload", "value": "68103d2bc870d66e218666c25a2a5229", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919518, "uuid": "a76845c1-c801-49f6-ae18-0040df77e4e4", "comment": "Malware payload", "value": "d6d4bedba63e50f267de3fcefebd0ebd6635643283e3cee15e00e7b016b9f27d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919518, "uuid": "73da40ca-5b03-4785-9c1b-14f3ad69cd36", "comment": "Malware payload", "value": "0394827cfa26784b957f7d45f2700c9f763128e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919518, "uuid": "4f43ab16-a942-498a-bbe4-dac6d481dd41", "comment": "Malware payload", "value": "6b4c6ac3e0f76aaf1e7c8a5fed60d8c78e4b306ff0bc0355ebcb3228573642678895af6a717a3da02c29783a43a3bbf3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919518, "uuid": "a520fdf2-180e-43d1-ad55-e5072e654afd", "value": "T107D31A5F58E3D163E5003E517B092B0B7CC8DDA52642332DE8939E256E98AB7F7D3206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919518, "uuid": "cab52887-a111-40a9-926b-f321465179a0", "value": "768:C8m/Z6sZjWsYuSwnckNuRbXQkFYrPY1T2L1epD+J4e+6ezcVCA2FRhq5hN0P0FuK:CPXZ6uSEYMFXpK4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919518, "uuid": "8e8edca6-3e55-4463-b4b4-68c2b877cb4c", "value": 138942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919518, "uuid": "29b37170-a600-4956-b120-c85b02dbc77d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919518, "uuid": "58b48db7-f3bb-448a-a105-1f1ddb1d3f6f", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ede341-1157-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1771920388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920388, "uuid": "1933c721-99e6-4e1c-9a77-5b3f5d5bd36a", "comment": "Malware payload (NetSupport)", "value": "aaf5afd63b231250e82e1b1efc928559", "object_relation": "md5", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920388, "uuid": "6926a407-79db-4d80-8900-10e8555879c5", "comment": "Malware payload (NetSupport)", "value": "d6d8b7c78c298467160914a538f62b301f74d62095240a4c6804946fcb9d7ae6", "object_relation": "sha256", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920388, "uuid": "12e12382-5632-47ea-9dc8-b0a352c8c535", "comment": "Malware payload (NetSupport)", "value": "97e6e79d0fb1e8fd6156a45b461525e17c1be404", "object_relation": "sha1", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920388, "uuid": "352b605f-9463-4de6-89b1-d71ed893dce9", "comment": "Malware payload (NetSupport)", "value": "3a4c25d27adc829f4245e7461ba743564bb37b54735514338809bdab34b601beb0f19ed2f7fa7e31db8203cce225934d", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-110-149", "colour": "#B856BE", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920388, "uuid": "7063c3b0-8dc1-47a5-ace0-7140d8a83d0a", "value": "T114A533C9FE04CD19E708B2BAD3C85CEFD9BAF15C4C5C16C0D9A9978A444D9E839BC285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920388, "uuid": "82798fb6-0bed-423e-830d-9a562c51db83", "value": "49152:TL3OcoOLUZT6N/PQO8uE7eRjRfS6XxrHArLVm3Cu9d4z2TxTxH//ioy:vS0Y6Nwp6Rj1XxrHArLlk4zwf/Dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920388, "uuid": "75df52ad-effc-4b93-8549-6c15367d637e", "value": 2234637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920388, "uuid": "9bd42c78-2f34-494e-a0af-83ff7d68f0d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920388, "uuid": "d9d56f74-365c-44b3-b278-cfbc0bb26455", "value": "software.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35cb8a2-119c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771950068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950068, "uuid": "4140984c-27c6-47ef-91ec-9cd7820c8e4d", "comment": "Malware payload", "value": "426ba7f7820a6659e065e48324fcb3ee", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950068, "uuid": "b1e10e18-9a64-4f2a-bd5f-f735cdee6dd7", "comment": "Malware payload", "value": "d7a2c8c3da396f3dd120ff1cd527909c9c045d4a7b503ffbb3371d92120ea8df", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950068, "uuid": "363973b6-b26c-4b62-be02-ba6ef367b4c0", "comment": "Malware payload", "value": "ecaedbed2ec9a558552250e0feecda25d0e6083f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950068, "uuid": "fb3e041f-7289-4f9b-8aa9-3217e1cc1a0b", "comment": "Malware payload", "value": "cf96f83a9ee5f35b3ee6934097d71f589b4433429ba05d1a8a2acddd9b91275894a7ef03234ca413da6e219a4ed1a58f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950068, "uuid": "48fb655f-1fb4-40e0-a34e-ebf85aaafe85", "value": "T124C73388A466D908D47F96FEA7549CF4C6AA4410FB95844DE0F81BC1CFE1ABC43FA44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950068, "uuid": "37c41f9c-4ed5-403b-8a13-ffea65096822", "value": "786432:WDj4YWi6mlGvkAzzUzOJdm5OxIUhhtiavvDyZKMl4iESHr3veOEP9MUzjA5oLn:WXF6QokSICJ8u9vWZ74iFL3v6P9RAOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950068, "uuid": "683ece52-fa8e-4be3-a3c0-24fa08ade49a", "value": 57047863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950068, "uuid": "40a340a0-aa4b-47d6-86cf-c57801132e46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950068, "uuid": "42d0d95d-5e09-4c4b-a318-0da0b8ef1d58", "value": "2089438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad923c-1177-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771934043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934043, "uuid": "a99fa139-db63-4f1c-a895-b5b9e86bd070", "comment": "Malware payload (Mirai)", "value": "f5499f38476a225f8eb5562d8649e6be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934043, "uuid": "69a7cbb5-31d3-4b58-ab9e-e778953789b3", "comment": "Malware payload (Mirai)", "value": "d84aedd1f90b149f192e9ec5214485fc494506a3b994174aeed8dfcd3a25bbe2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934043, "uuid": "220d0d06-53e6-478e-9ab8-dd3e4b86f609", "comment": "Malware payload (Mirai)", "value": "ead794aec5d91aebb5df1deef9fa2ede734f89d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934043, "uuid": "9a4f6325-75a2-4aec-a72f-120240c12c76", "comment": "Malware payload (Mirai)", "value": "a54ba49aea04ab2329bd422f9c667b7851aa11225f75ed88a69cc1d44626fcfaa336f04c1b83430836fc78c4b1e1787e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934043, "uuid": "c68897bf-35cc-452c-b054-2dcf724fdd69", "value": "T10611D18DB0216BA3258D8F49F3B2129CB04085C626EE0F61FD6914B7CEDB60577E96F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934043, "uuid": "de791052-1a18-433a-a4b8-0a149e49fe4f", "value": "24:0HUQXeh+ODuNIA2KfKm9hxqbuW+OdI5CJDxe8tTVH7KsGcyOtIvFNA:UuhWfFQkJ0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771934043, "uuid": "b32e2087-8a82-44ea-a80b-6186ff56d3f0", "value": 1089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771934043, "uuid": "72e5583d-262a-4a96-b819-4e2201cd98a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934043, "uuid": "a363303b-4ff9-49bb-85a1-958c2b610976", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977f0619-1196-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771947390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947390, "uuid": "4e359099-1ceb-415f-a95c-aba55495eda9", "comment": "Malware payload (AgentTesla)", "value": "1e9f7d4ded81b52e489af7263c79d1a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947390, "uuid": "b1c209a8-1480-4881-a4db-3ace2e46b1e2", "comment": "Malware payload (AgentTesla)", "value": "d8903e265c9f3f1df7a603972873758224fbde9463b94ff2223b689f972dd1d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947390, "uuid": "cf61af84-129c-4a80-adc4-2be58d7e67a5", "comment": "Malware payload (AgentTesla)", "value": "3dad35d81fb4e45ba7e3e1f479601d8f16a51185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771947390, "uuid": "83dba9e2-89c8-4900-924e-3e93902be4c2", "comment": "Malware payload (AgentTesla)", "value": "51317d89f148d8bc3da9a83daf4c8aa2bea09ca5ab0d4d126a58b8dd5d897be4821e5a46cfbfa9f21c20d8e91ae60588", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947390, "uuid": "21a0e04b-fa70-4808-8c4b-fe3d8d4fbe07", "value": "T17C827336FA18DFF40B2E51E5118B7C06605497A6A83A49ADF88DC1587F27B108FE74E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947390, "uuid": "cc6874d4-a7f1-4df7-8dea-d831cccef67f", "value": "384:ok1efKoK7qz/egkhmr+qyoWjwt2xitnC/qP:oF7/Gqyo97USP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771947390, "uuid": "73253f3a-3510-4520-8ba2-6badec65e1f9", "value": 18387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771947390, "uuid": "cfaa4af4-cec3-4b39-b053-85362c93b490", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771947390, "uuid": "661d1348-1590-4d33-a5eb-8a32b794980a", "value": "Doc_018_302_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146502cf-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897349, "uuid": "ae63ce64-746b-4e8e-bea9-1e70061c4458", "comment": "Malware payload (Mirai)", "value": "a9b772fb2851900b26f2604bc1547525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897349, "uuid": "07cc186e-042d-4940-b94e-25872c392567", "comment": "Malware payload (Mirai)", "value": "d8985ccccad286cc3d7101f8fa5a1ffdf3689d52b4100b6b543bf3496edf420b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897349, "uuid": "f87827e3-8878-4067-b593-c286b808cbb2", "comment": "Malware payload (Mirai)", "value": "4fedbe68df584a62c0a1bf91dff81be01ba4d2c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897349, "uuid": "8c304e8f-6f42-499f-ba05-b6209f657a89", "comment": "Malware payload (Mirai)", "value": "259372d3a5679f6aa8c16aded3208411b216d59e7ed7efe08c4bd2938beb0ef4ce8dad20200d1366d0616fe94a1f5320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897349, "uuid": "e56c9fb2-9d4a-493f-930e-5f7e07f3cc64", "value": "T11923F189F4686565DC5F1D3A6CED2A962993F0C236978B8CB3316C68F324CC12AC64B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897349, "uuid": "2897bf9e-7720-461d-bc9c-4ab46d634b78", "value": "768:Yj38dwSWkcb8OniN1onqwBjNFfCsTleZFxdBg8nxohMFAhcddXe87qehWOO:YjMdLWkcbsqRBjTrc9dBg8ncMFAhcrN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897349, "uuid": "5d6af64b-4ae8-4f52-a771-7fadf4bcb73e", "value": 46940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897349, "uuid": "29b8daf2-0099-4cce-a665-f8cbaf19972d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897349, "uuid": "83c7f71e-75e4-4023-9f01-3e8aa83be0f2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e91416-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917429, "uuid": "2c47e035-b8af-41f6-9600-10cd5b960347", "comment": "Malware payload", "value": "3eeb965ca4a748ea750f24207a03a873", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917429, "uuid": "29c077c1-94d8-429f-a253-b7efb21793d2", "comment": "Malware payload", "value": "d8ca36ddb32693982944f63096d63d3a7b67caace99cea5ff52f43f7b0596dd6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917429, "uuid": "dfea7ccc-9dec-49bd-93c9-04e80acfda60", "comment": "Malware payload", "value": "a40df3bb457089dda329cb815834bb4fcbd59fd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917429, "uuid": "4830be6d-066b-4605-85e0-683a561e8662", "comment": "Malware payload", "value": "ef62a83ae80b3f6288ca2705c24d66d63e5f56f08aae92da4b7ef764d60da29ed3ea297530c517292a18c59757df39be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917429, "uuid": "e71e234d-cf20-492e-b433-8fe378b848d5", "value": "T1FED3C9914B36FCFDE4DD25071C64A36B276EA2B58306C0DE00A72A134F996DEB4DC897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917429, "uuid": "82886d9f-6311-445a-a8ff-6a3ae1aa81c7", "value": "768:C8m/Z6sZjWsYuSwnckNuRav8v8vzv7vDvAv9vAvNvJvOvavovtvsvjvxv2vHvhvs:CPXZ6uSEYSuFspG4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917429, "uuid": "a1b38399-2436-43ab-bec8-551eda6bfc28", "value": 135115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917429, "uuid": "d51ca623-a140-4522-8f7d-c6366d898e10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917429, "uuid": "ffd94380-72dc-4230-a395-9f4017a92f4f", "value": "invoice-1645080830.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7662d4-11b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771958728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771958728, "uuid": "14add1a2-014e-42b8-9419-535dfbbed04a", "comment": "Malware payload", "value": "389041588dac09c2588e429bcf5ac138", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771958728, "uuid": "e319a780-7e46-4736-9c51-cdac7351edaf", "comment": "Malware payload", "value": "d8e9a04398d86bc1ec4cb5a4c927bf29fac1ad9071a0a3878215a2ec6a4d4308", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771958728, "uuid": "df94321d-ced8-45c2-ad17-ec3ecbae85b0", "comment": "Malware payload", "value": "d73654e07bb894ec3b6cae5a46ee4bfd010185d7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771958728, "uuid": "672070f3-2f0e-4f2a-b45d-947e3de62262", "comment": "Malware payload", "value": "62c96529b3d7f3daee6d47bd1fbaf029c4d71f8656f7f4face01a09595f81bc36f886fe0d9c5b660f19bb972439dc34f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771958728, "uuid": "75ae6ffe-b466-4821-90fb-17e98c14a016", "value": "T1EEF1A6199AE416ACC6E3596A0D4396253A3AC13B913E0E44339CC196FF8533EC7552EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771958728, "uuid": "423ecdf7-127a-4196-88f9-ee81bd37ea34", "value": "192:in0IlzmZAz5z5TbbIFZfrjo88cqAEb135w/nneGtPj/9jn7yiLCN7o2:in0IJMAdz57mZfrrPnxdSM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771958728, "uuid": "6c9ce36a-3e09-482a-9309-5ebbfd298982", "value": 7948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771958728, "uuid": "643d1ffb-c5e1-4ae1-bf63-3aa6dfad6b0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771958728, "uuid": "c7f5cc50-885e-4a11-9e5d-f633223f91a6", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3af94f-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919535, "uuid": "30d7f9fe-1d6d-4575-8128-886de587604f", "comment": "Malware payload", "value": "67cf8a8b520ff984976634ca571f7bb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919535, "uuid": "4c5baca6-a498-4d04-970c-5bb152f53602", "comment": "Malware payload", "value": "d95622291da73c6518f20985eaf305b6cc29c76b4e3556f5cbe174787ee344b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919535, "uuid": "6f53b396-ab13-444a-b93e-947ab64ca6ab", "comment": "Malware payload", "value": "97e030d54b11332a2065b53ca67a19cd0a13e834", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919535, "uuid": "d656af46-71a5-4e6e-af80-e5380143f3a9", "comment": "Malware payload", "value": "9dbe9e0635b0994f7a64440e98289f596e3bd129479ed4989fb21a87858960e967ea40148087338e1fedee333cbd10f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919535, "uuid": "af1b7eaa-d711-4432-a332-47c182ef36ea", "value": "T141D3B98C4D0AF3ED1EA82114FCDB4F76996CB18E394454C6A5AF3B07E61E21A8D1E5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919535, "uuid": "a36678db-e499-466b-bda1-44c86c7c854f", "value": "768:C8m/Z6sZjWsYuSwnckNuRYIarjSEOy1MIklzKZ3DRdwbdJZvTGiyrzWZ9DXzqprk:CPXZ6uSEYgprFN0I4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919535, "uuid": "11bf31c2-31f0-417b-9394-328adcec7df3", "value": 137047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919535, "uuid": "a77b9ead-e45d-473e-9d91-991334f65824", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919535, "uuid": "d92e1358-f6bd-41b0-ac4b-93a1b57433cf", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60566972-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771921958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921958, "uuid": "4aefd75e-f0e4-4b3f-b3f7-3e6e68d187de", "comment": "Malware payload (Vidar)", "value": "0b302b2f0b83a1592ae9fedfa58ace12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921958, "uuid": "dfacef29-3e1a-4650-b888-8264b0ea52bd", "comment": "Malware payload (Vidar)", "value": "d9dc5baa9925dfc46ed15b4a2c24ecfb09a8083d5447e1d7e94b862874fb3466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921958, "uuid": "17933a1a-88df-4c45-a291-a2b8b556228f", "comment": "Malware payload (Vidar)", "value": "0166877f814ecd808b85d89d5549e24952302bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921958, "uuid": "ae49a77a-e5fa-43d4-9780-929b1ae19e46", "comment": "Malware payload (Vidar)", "value": "6308a1705b6736257eb1de3036a8f8edf17a2837d131b1b0017304ab47aee9d0844973203361c7b79c71f4498e626456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921958, "uuid": "004d5790-3abf-4769-afa3-87ebf412a5e5", "value": "T1192423145874CDF8CAFD66F657C612AA8387D6116EB2DEA32BC2CCDE427984480EC9C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921958, "uuid": "e5b5239c-dcb0-4fd4-8f99-d5406556ec3f", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921958, "uuid": "1fb90c9b-605b-4c5a-81a9-4c5a5c026b54", "value": "6144:EMV3ljeWU2sWZVlfTjofo5J9k8bGwu29QsGk1f5TVMdnQcR:9V3ljI9OVdooHbC2JGk1fU2cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921958, "uuid": "26c52106-ca9b-4121-b9d4-1ec180893207", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921958, "uuid": "03a9335d-6f08-446f-a385-b9aa03d5f25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921958, "uuid": "13d67660-031e-44e6-9645-7aefcef1dd1f", "value": "Payload (8)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493b3162-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771960574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960574, "uuid": "9b5bd588-5db3-4251-9788-4d97212d6fb8", "comment": "Malware payload (Mirai)", "value": "382cfd69c683e5184cfc91a808992fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960574, "uuid": "3b4d26ad-5a62-4d65-a35c-ae32da1be731", "comment": "Malware payload (Mirai)", "value": "da0ca587f01773ca3874d317eb01c20d5103e806c1b608a141f49370787cf384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960574, "uuid": "120b9b1d-120d-424b-923b-26cee3297724", "comment": "Malware payload (Mirai)", "value": "1d794b12f86b8ed2c5bc0c65ebdf40c9db90f5f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960574, "uuid": "65b945dc-158e-4afa-b250-ac3ade5d3b97", "comment": "Malware payload (Mirai)", "value": "316c2c6d531eeb2a2192dc81ed6475e0f0221cd40e819d2b28be6aa9ef9852552b2d5492c71c944d724ec26b2d317dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960574, "uuid": "2f2f5aeb-d6af-4769-9fe4-9ba66fe6d9a0", "value": "T13FE31A41F8405B27C6D622BBFB5E428D372A17E9D3EF720399216F64378686B0D37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960574, "uuid": "724f5f40-d96b-40e9-af51-81e750045a01", "value": "1536:rn8/rG5pWBij4iPQIOCnPYEJ9yHXWUAkE94VItdTLDVmFAaVAOvqIUCSxWdpjcsG:rn8MwaYcM3WUa4odjVmF9owSWvjUXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960574, "uuid": "5b215a50-96f4-4995-a8fe-8bca43cf1140", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960574, "uuid": "022635d8-9ee3-4352-8373-20db0dfdbd98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960574, "uuid": "f33d3cd0-9458-4814-b076-444c6b4b5c46", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b0250f-1168-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1771927577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927577, "uuid": "4939287f-a15f-4a0d-9b2f-da6d8e0c76c4", "comment": "Malware payload (Cobalt Strike)", "value": "ba02ed68bee9df68394ce05df073c84c", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927577, "uuid": "5e42d03d-7fc6-4bd9-8d76-cd4ca2ab6f24", "comment": "Malware payload (Cobalt Strike)", "value": "da8c83eae113475945a9ab217acf0a375f690e3da0205fedf6f3b176cb9ff45b", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927577, "uuid": "595eea87-ffcb-4cb5-b65f-e2b5b744ccf8", "comment": "Malware payload (Cobalt Strike)", "value": "43e2d3e7a3cfefa7b09199bc3940d533b91ee17a", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927577, "uuid": "584121c5-4913-4407-b14e-0b23c73b9076", "comment": "Malware payload (Cobalt Strike)", "value": "ca63140684ea651b5212ab4165818efd4c7d1a4d7add50a9a18893cbecc05cb179220d747b6ae5dfb04c11fdb0145799", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927577, "uuid": "0f7e77e9-298f-449d-84ce-5b320f95f674", "value": "T1FE554ED06BA6ACBAFB88B034A50049717D8EBEEAF5C211DE32EC751E167357544F4C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927577, "uuid": "7c2b4ee2-7641-4776-a3b4-7cf032258189", "value": "4db688704a7a98f8d5bbc53c31602749", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927577, "uuid": "009d3d10-b6bc-4849-9aaa-e30063b6c949", "value": "12288:oerLmeKBbwwn5o9SjBZXiTodUvEB61MSjcj/C9nH:oGKBbNocicdOEB6KSjcj/kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771927577, "uuid": "3f8b05c8-10c1-4b66-a5e0-d874ca9a9bed", "value": 1331584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771927577, "uuid": "35776a54-de3a-438a-aba5-a5f3acdc55ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927577, "uuid": "c9b257d7-c6ff-456d-bb4d-013803da32ea", "value": "\u6df1\u4fe1\u670d\u8d22\u52a1\u5ba1\u8ba1\u76f8\u5173\u8d44\u6599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8022985-11c7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771968598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968598, "uuid": "c5289031-a859-4d7d-a759-e5d15bc70536", "comment": "Malware payload (ConnectWise)", "value": "e50c445bb5bcb312a17efd6d2c6deefc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968598, "uuid": "17f5fdaa-e89d-4e7d-9530-66f7f2c07e29", "comment": "Malware payload (ConnectWise)", "value": "da981ff73b98d1ab4670f5dcde1e2b956d7acd3ae4af2f6d778ab7cc0ce85701", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968598, "uuid": "5d0b051a-9c46-4766-9cff-8d094a54956e", "comment": "Malware payload (ConnectWise)", "value": "a2805810a95963fece14dcbadfe7a6eccf9c4aa5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771968598, "uuid": "67992f01-a4dc-4093-8697-b2e6e58bf0e0", "comment": "Malware payload (ConnectWise)", "value": "bb86184ddf8d82edabd2e9ad72e1e339ad3ac279c8c709d6763fc1a19b2baac42e9f89bdf8efcccdd03b4f49c172de26", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968598, "uuid": "9e40cec1-56e9-48be-9370-f96f3e844adf", "value": "T1DEE6125173E945B5E0BB0B38EC7A86526A34BC049B16C6AF57A4792E1D32FC08E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968598, "uuid": "2711eda2-947f-484f-9311-fe3dadf5ae9a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968598, "uuid": "956a757d-fc07-4297-93ea-07cffcc2a965", "value": "196608:j1EfefPkBKaLNkbgai4QjKaLNkbgHKaLNkbgaKaLNkbgJKaLNkbg0:jqWgaiH7WgfWgsWgtWg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771968598, "uuid": "2fd58ddc-65e5-42cf-b727-269c5a2462e8", "value": 14878776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771968598, "uuid": "bdc30d63-ce5a-4131-a334-a5294bd0346c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771968598, "uuid": "17cc2767-ed31-4c79-a509-d0505051df06", "value": "New-Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3400bbfc-1153-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771918447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918447, "uuid": "3169ef93-461d-4237-9d81-043eb379cdfe", "comment": "Malware payload (Mirai)", "value": "23e1971c4bf0f2496fe707a68602e0aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918447, "uuid": "50fe51ae-1632-493e-87cf-7ee7dbdb54be", "comment": "Malware payload (Mirai)", "value": "db8332da87936c4e44b1ad98823de83395f1d0db5af0f9e99a2a13d02bdb9a88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918447, "uuid": "8f2d97c4-da4f-44db-95c8-0f243a2148f9", "comment": "Malware payload (Mirai)", "value": "632b875186d657f7b2cf17ae374cf0108f11bcd1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918447, "uuid": "1cf30b71-299e-408d-8ca9-ffdf7559d16d", "comment": "Malware payload (Mirai)", "value": "16683e3bcdd16d3e232d8d415a6b8cd0301e58e1d575ff3485e4a4bcaef0735a08a3bfedfffd37d6f8a3f0e07be5fabd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918447, "uuid": "193d2219-892f-4b9b-883e-d15404331e72", "value": "T16F5193C702510AF97C63BAA3FDBF8EDC3686509268E17F0456DC34E5629CD9834D8A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918447, "uuid": "927f0713-d6cf-43d4-b0d0-f2080163c1ea", "value": "48:inohmlnKnElnfCXlnTePlnaOazvZlnaUaFvjln9N89z4gelnejclnPSvlnjOjzq0:i6mlaElKXlqPlaPzvZlaZFvjl9Yz4ZlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771918447, "uuid": "71c58416-37aa-4d3c-9bc8-88feb3c97560", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771918447, "uuid": "a3371c34-da82-4605-a282-c3f20db3fe8c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918447, "uuid": "b9a6ccad-794e-4aaf-91e0-a9676307f96a", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b2300d-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771960756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960756, "uuid": "e7917161-6d48-4a72-8b20-59e625cf175d", "comment": "Malware payload (Mirai)", "value": "56433c761bfa8db25c0cb8d8323c52d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960756, "uuid": "8796995d-07be-4ec6-99b8-3947334ec41c", "comment": "Malware payload (Mirai)", "value": "dbb2ede1b954889d94a61c2c0ed6d9b36545180f3ba231e5c9cdd179b80c845c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960756, "uuid": "fd559fad-6d4c-4101-8282-0cd3c946cd1a", "comment": "Malware payload (Mirai)", "value": "80a60ec285003bc681fc79007811d9a8c37d43e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960756, "uuid": "be6181a8-71d8-47f4-a52c-c2c2c4452cef", "comment": "Malware payload (Mirai)", "value": "1ce2e8db6da89d4578c40f24be3777f9962ed8a4be28dd61938f5536b26e5141dde98d4a1b3d10ea9d7077c4ff3b9304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960756, "uuid": "d085be25-0648-4be0-966a-b6daa10de4b8", "value": "T1B0F33BD7F801DEFDF80AE73A48570909B530B7D210825B372257797BEC3A1991963E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960756, "uuid": "6a587222-5dc3-4e09-818b-8ec7aec504d0", "value": "3072:JNgSgvtNHgyOoF0vyI5j0e/7iwW8iz0naiVxjbi+L1/EHqLO:jgbhKvyI10e/7hWKnaiLCqLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960756, "uuid": "56161e23-6a79-4216-83ed-8c479c33bd51", "value": 163680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960756, "uuid": "421ab83b-cbfb-4bd5-bced-25bb2175ee3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960756, "uuid": "89e084ae-d8a0-46ef-89ce-f397673aabe3", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5d9b97-115f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771923832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923832, "uuid": "f1f4bc0c-9ccf-40d6-ae7d-ad8c46ed0300", "comment": "Malware payload (VIPKeylogger)", "value": "c981b8144e2aebd6080858b04af3b600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923832, "uuid": "be156000-2df1-4273-82e6-e60d1c7666ba", "comment": "Malware payload (VIPKeylogger)", "value": "dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923832, "uuid": "a9b732bd-1acc-47b7-a220-54940a0e6f18", "comment": "Malware payload (VIPKeylogger)", "value": "4840c94508f6f9ebbd7389aa7e53a3436bb0d0c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923832, "uuid": "d8bb62b9-8fdd-487e-9082-74d039cdff9d", "comment": "Malware payload (VIPKeylogger)", "value": "01f7863e2c6b896d911e320c9a33f3c0114ddcbc5eee4026164c8eebbc533024370fff56f6a0d2fb582c8d5643a475d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923832, "uuid": "e97c6d30-6455-4b70-bceb-ab98400450fc", "value": "T1B815E0615EA726B5E89C0B78C023089C33F4E4071166DB6F0FED84F5AFAAF96D917850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923832, "uuid": "84c8cd56-f63a-4477-b427-f8965944b6a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923832, "uuid": "ee2cbe85-1683-4ee9-886d-166711351271", "value": "12288:W1kJXxY9bXvXAdpr+8Esd4sEwRA8DX2YI1Qsc6F3lrK/CDS:0exAIdZ+8EsdfRA8DXsjF3le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771923832, "uuid": "c256b830-be67-453c-8000-be363fccb83d", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771923832, "uuid": "aaf489a5-a1b9-407b-a6fd-f65ada58b424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923832, "uuid": "74a472ee-857d-44ce-bfa6-0e28aa9307bd", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b919d7-11a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771954343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954343, "uuid": "18ac2810-e7f2-47a8-8e92-4a13a4168e56", "comment": "Malware payload", "value": "b0718048ade3fc15f5a5ec16d8933f2d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954343, "uuid": "a8951a35-acfc-46af-ad93-197c20242b5f", "comment": "Malware payload", "value": "dbf0bf5cfc6567e82f01854f672d8a419accee8d5a7d19f820a90c8490b6c871", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954343, "uuid": "ae93a65b-5de6-45df-b579-dbd980e5a87f", "comment": "Malware payload", "value": "ffdb536c4ce6f44629accd753bb286be5d0c99de", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771954343, "uuid": "cda17f1f-792f-4583-bdcb-9632e108d788", "comment": "Malware payload", "value": "3b30d6b1ee67dd2f7d21381ac309dbceac55dd7df2832d56db91cc61121fa3b301db87d31a804bd800068e049e97db16", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954343, "uuid": "06993413-55b7-4d2b-a77f-82aeb4d20f19", "value": "T1ED841265B70C8293D7178CBA1AC2E1C6670DFC16EF02970735EAF70DB83628950D762A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954343, "uuid": "7cae8e89-dbf2-43cd-b639-2083943da8ae", "value": "6144:FNCsb8uYo5X3LV7IY43fSXrVMD5cZVmBHL0dWBiy34ngs8iQW8i1:FNCpuZVIj3fSXrVimLmBr0rs4nB8iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771954343, "uuid": "42c0259f-2986-4386-975e-e49f2e3ffa1d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771954343, "uuid": "e496dcac-8d5a-42f1-b85d-31949dc6a726", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771954343, "uuid": "04e64e2b-3269-45a5-849c-29ddfb5b951f", "value": "SecuriteInfo.com.X97M.DownLoader.2343.11556.20398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974e3839-1187-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771940948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940948, "uuid": "53d4f691-7999-4273-99ee-81f1157e1ade", "comment": "Malware payload (Formbook)", "value": "64f6121c95125b9d3f81fea9ac5a99f9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940948, "uuid": "1c0cc76e-4858-4203-a2e0-2bb57234481e", "comment": "Malware payload (Formbook)", "value": "dc8a316ddc4d56791f78f417e0fa86f36a545f58a64ba165ae6ff41c91068983", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940948, "uuid": "4be866a0-f3b9-4d84-85a2-1426dff0d571", "comment": "Malware payload (Formbook)", "value": "da17882f9c26c2acd2bea43a5fefc9ae48f618ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940948, "uuid": "ef50236c-fc10-4847-87ae-361758b4db65", "comment": "Malware payload (Formbook)", "value": "a28a06711daa11b05117c974bf4f78d81315b7846a2ae820be2ae3283180c78822cdafb69c3f9e2e7abcb2bcc2ddb0e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940948, "uuid": "5fa8870f-7b7f-42e1-9148-17cd568e19be", "value": "T16CF1E5C962B46734D64325A62880F7556FF70C471D621C86BB0FFAC7D4623180AEABE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940948, "uuid": "3a8bd6d3-703f-45a6-ade1-5939935fb496", "value": "96:vx+Al2+TbKT+KpT/yZjJdKT+mKwal2+ywK+wKbwWz5TbKo+2iPqOl2+vV6KgEiKJ:vluBjqVLK8iP1dvr5BEhokiRRfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940948, "uuid": "b59fd33b-df2c-40e1-acf2-19d19675e59d", "value": 7935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940948, "uuid": "19701699-a3ea-46d2-97a6-2b557fb0b762", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940948, "uuid": "b9c6bb37-bc66-46cc-98ab-1a65a83933ac", "value": "Proforma1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef42b5a-114d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771916050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916050, "uuid": "3170f689-0032-42bf-a6ec-510743d83b86", "comment": "Malware payload (njrat)", "value": "0a79f47cdc25e3abce14406055914603", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916050, "uuid": "f316af7a-9a7a-45ee-91a9-43035a748d80", "comment": "Malware payload (njrat)", "value": "dd04f418685c2c03217c4d17c371a1ab82b2f67e8d7f723b7990e209d8be9b51", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916050, "uuid": "6e194c8b-4866-4632-a835-c13704a03444", "comment": "Malware payload (njrat)", "value": "4f062d51e1a5c2bbeba1266bfd0d2a8510c5b06e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916050, "uuid": "2c372c4b-ca83-4a03-b35d-b05f916e7a5e", "comment": "Malware payload (njrat)", "value": "c6b56bd71772c47a88e5debddce3e02466f0339d2fd9c63cbcbb74dcafaee32ef0808aa2e8d8b984e676c268a45b0f92", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916050, "uuid": "1511bc21-41d6-485d-9f29-97580b03c165", "value": "T124B47EE74C97B05D80478754062AE9485FDFEAD18BE025B928DD950A0F4C3D0BEA7FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916050, "uuid": "f20ae3a9-4e51-4ddb-be99-5fa46f1c2da8", "value": "12288:ZTo55MyUQsKqWcHXF0Pk77NFmCf3o7L3vhtovyDO:V+myUQQ7b2L3vh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916050, "uuid": "df1211f5-9e8a-4de2-b1fa-a353399d898d", "value": 510337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916050, "uuid": "f2505153-6bb2-40aa-b3b3-4c1fe07b7ef6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916050, "uuid": "f62cc8c0-9373-4480-bf3f-6f39bc0c12d4", "value": "dd04f418685c2c03217c4d17c371a1ab82b2f67e8d7f723b7990e209d8be9b51.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edd28f2-1157-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771920103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920103, "uuid": "1ad4219c-bcdd-47ef-a5f9-13f3a95265bc", "comment": "Malware payload", "value": "ec11723a6b66f83d7719be0199027fbb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920103, "uuid": "d91cbe30-91b8-4dbf-8b87-4b2f19bfcda5", "comment": "Malware payload", "value": "dd279c3d027cef5a712bd504ff20939f016099bfa82d96928b47df262ff4bdd9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920103, "uuid": "7ca234a3-51ea-4b41-ab11-23ac5f2d34ed", "comment": "Malware payload", "value": "4725c783e33c3ef3d314b23a3c0aa9852bf1cf63", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771920103, "uuid": "86afaad6-9579-4d17-a195-95540cbe477d", "comment": "Malware payload", "value": "c336d62a9a1b42b3686227052b345a89b08d952f8b85d577ed21c853ffd3a166273f700145bbec2ce8d4c98726ae9437", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920103, "uuid": "40181747-a42f-4c00-b344-5d65536879f7", "value": "T13E73F803E2E410FCE1D8C278939B9A37DD31B8C9563469AE27443A122BF7E507B1E675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920103, "uuid": "6a9e9dd4-1960-4e74-8268-da15125bdbe0", "value": "1536:Tj0dU4VjTQTUdvRwbkGrY7WM92yjqtFlwHgoY:/0dUGQTUdvR8LY7WwqtbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771920103, "uuid": "93cb331d-fc8e-4dec-803a-cc6511f283f4", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771920103, "uuid": "c579ed2c-2bc7-4d69-a343-05030a8bb8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771920103, "uuid": "f1f97da5-9b05-485f-9b6c-0fabbf9d1c79", "value": "Documento%236124.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f217027-115a-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1771921499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921499, "uuid": "175e5793-9910-41a4-8701-e53df43d9eed", "comment": "Malware payload (BillGates)", "value": "45e55aea0a12696f193d29ed1d5319b5", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921499, "uuid": "1f418a44-7afd-45dd-96f4-734acc5e55fc", "comment": "Malware payload (BillGates)", "value": "dda48f848e61cdb3cbe480e5808c3573a0d5c49c034fd5f95b8fbf39f50226b9", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921499, "uuid": "6c24c610-8f02-4a8c-94e2-b885ced98f6f", "comment": "Malware payload (BillGates)", "value": "c0057f9bac18d814c34a7d30aecb3b48c070d643", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921499, "uuid": "71cf7b32-2205-470b-8560-813910cb5adc", "comment": "Malware payload (BillGates)", "value": "a447f1efb04841b50091b6688350dc4960ca43a093993e06d8ea958e8b8cf2114b4dd0ff97217f0cbee133d8e30c5708", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921499, "uuid": "534fcab9-291e-40b3-9607-511af36958d4", "value": "T1D3C56D11FDC68CF2D4071A71005FA27B52319E1A5B26DA87EA48FE38FB375815A3632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921499, "uuid": "8269fb9b-ad9d-4018-81c7-71d1f1b99894", "value": "49152:ES2xjAKkR45vRVJKGtSA0VWeoZu9puiKMl:12xjbkaRVJK0SzVWXu9pxKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921499, "uuid": "7975e045-bace-40b6-8f7d-6c332b4958a7", "value": 2744472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921499, "uuid": "b9d51164-f10a-4d23-b34e-ad27a407b017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921499, "uuid": "245ad1f5-6086-4ef6-813d-93244b878734", "value": "kal32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75de0e87-11a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1771952059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952059, "uuid": "8ee90bbd-2a35-43ae-974d-c27554cda4a9", "comment": "Malware payload (Hajime)", "value": "fcdf34b519da5a9ba337ea1a51c96e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952059, "uuid": "fec5e1e7-01d5-4bcf-ac3c-8476af837bc0", "comment": "Malware payload (Hajime)", "value": "de15bcebccc0c63a2616fd6e4d64868caea1c36c88ffd343974c629a2f28957e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952059, "uuid": "c067b6ae-4727-4342-8b16-957fb29ace65", "comment": "Malware payload (Hajime)", "value": "94263827cf30fd19f0a951c0dbc87c7cb7b3a940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952059, "uuid": "1221a5a0-0ed3-4c00-81c5-53c6dbaf19b5", "comment": "Malware payload (Hajime)", "value": "da95590f5717b289eff5669d37570c5b2eec8268c18bd0f3bf9660770b6c6a001cbc7b7f376c5fe666b6acbbcbf67105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952059, "uuid": "e9c7e0f1-ffcb-4626-bb82-561a98ab98e9", "value": "T1F482E14626983703A4B155F1F73CBE98B3022E9DAB7B94279089612350B312FE604C77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952059, "uuid": "daa680d7-7845-4f98-836f-f4355b1a2f16", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBs:YTYIDfYG6ZmewZ59+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952059, "uuid": "9b17926f-fbce-4668-99b4-a805c06b8229", "value": 18872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952059, "uuid": "47a69f63-b969-434a-9de1-1904ccf8e487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952059, "uuid": "edda13bf-b280-4b3a-96ca-77fbf020cc6f", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862aa6c7-1177-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771934047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934047, "uuid": "8a9c2479-4144-4abb-b3fd-52f703f937f4", "comment": "Malware payload (Mirai)", "value": "d302f16faceb11aa4f9f3fbdb71f1c0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934047, "uuid": "9d24dff2-7077-41bb-9c4d-3621def99c93", "comment": "Malware payload (Mirai)", "value": "de4b291963c7e83414f82ed5622b1312ac11ab2435cf605ea426c28d11495f94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934047, "uuid": "ed0f045c-780e-40da-b4f4-42eee0db0867", "comment": "Malware payload (Mirai)", "value": "ea3f8a0c890e2161cc44a036210d4fddabae2cf3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771934047, "uuid": "3d40c9a2-cf19-4f7f-8e43-bc7f71292ee9", "comment": "Malware payload (Mirai)", "value": "95f012da549c0d0acbdaef8f85c2f0d6303873f1eba2ff00a3b6edd770c44b1cf09d5940b95d4def15b9035b4cb31af7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934047, "uuid": "980700ca-8090-458a-a7c0-77460cca59b1", "value": "T1FE6133D9E558416275EF016E6E93E09138478F7B01DB2B0C7C9E6A203FAC70CA32857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934047, "uuid": "03b0e376-e8cd-4b4e-b0b3-df11a327f267", "value": "48:V93LBDxkSWum6juGv/gzHNLIF73BQ7NapR9VDpFTbrb/kBdJ9K9bFjAchM6OG:33LuuRCk/fFjSW9xpFTXbkBNw2chGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771934047, "uuid": "7bd70e4c-195c-41b1-9fae-32505ba6e4e4", "value": 3343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771934047, "uuid": "ac0b770a-49b3-4544-9ad1-140ef9240c67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771934047, "uuid": "a6781b44-bca9-4917-9deb-8ce467ec9e39", "value": "1a2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e761e8-115a-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1771921506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921506, "uuid": "8ad52ba8-62d3-464c-b381-47126a394193", "comment": "Malware payload (BillGates)", "value": "a7e83c8d556405a858066443a24de166", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921506, "uuid": "82e78122-f29e-484a-8604-5e443c380609", "comment": "Malware payload (BillGates)", "value": "df25ef9f86602c619ea0d6702feb571efda915bc029efd05fd440c50e1dfa57d", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921506, "uuid": "8b2bc7e3-6344-4b42-a5b7-d43e1a9f3a49", "comment": "Malware payload (BillGates)", "value": "f40775dafa376eb8c8c3e9ac94d454e55679d693", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921506, "uuid": "c8cc60f9-c79f-4396-925f-20c414546be7", "comment": "Malware payload (BillGates)", "value": "5eade9ab39b124aa5d49877ef3bdbe33db88987d3932e050328321d9161add5cbea2ea85379c33b4a320c6c84a959360", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921506, "uuid": "4bbbe9b3-75bc-4b89-a93f-d3ca1d757f39", "value": "T144D57D03BDD08CB2C45A5272451A9572B671BC655B2297DB7F44FB3C3F366C0AA3A328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921506, "uuid": "0cbf35df-6a1c-472c-8488-af34287b11fb", "value": "49152:k2IbgRK6n45vRVJKGtSA0VWeoZu9pCY26+:cesRVJK0SzVWXu9pv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921506, "uuid": "5b9024fc-c525-41b4-8073-4194525bade4", "value": 2830488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921506, "uuid": "327cb810-d678-46b5-89a9-24b7d3b4fed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921506, "uuid": "b6192acc-83a5-4a2f-a8da-f2dc3047d8f3", "value": "kal64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8a9ce1-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919379, "uuid": "302511f9-0212-4442-ad80-1bda1712a661", "comment": "Malware payload", "value": "a9b3841b3e3c76c8035769019e48a9e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919379, "uuid": "a34900a5-7b5d-4816-96eb-df681b04877b", "comment": "Malware payload", "value": "dfdf8a0fe8d73b021f7a62bf894e09420e9c57e1279188692b38bf02954d944d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919379, "uuid": "aea3fc6b-cc52-4f1d-8a9e-aa09a36c4ced", "comment": "Malware payload", "value": "9f8fd487be1577ffe5bf4b6e95a0520f090059cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919379, "uuid": "8403d9b8-212f-4a88-a66b-1d950b720d63", "comment": "Malware payload", "value": "e141296b1e195b8f877ed8c8d28b26c422cd83d39d4056a265670a7b26f55708cb7dc3417f9b7234a020495bf986fca4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919379, "uuid": "82dd7559-1f8a-46c7-8537-713f7fabc445", "value": "T111D3B6959453C0660D30FE1EFA36F2B0F46A18706831D1B8E645B1FB1339BE79C6B46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919379, "uuid": "4fe2e00c-d811-4869-8ffb-cf87690e0439", "value": "1536:CPXZ6uSEYS68ei1WnUyHqfBn42T+pS+Cxz5p9HJImWwRBmjzmViOWiAzMUYiYYjS:CPXZ7YipZk4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919379, "uuid": "9d63ff77-9215-4119-8542-a531809bf48d", "value": 134160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919379, "uuid": "5310e93c-a5e0-4f6a-b8a5-4ffdc881cd39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919379, "uuid": "1b3d7c16-5a48-4abc-9003-4f3d2fd96e7b", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec78be38-1120-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771896852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896852, "uuid": "e160edc5-8952-4da8-9470-7d93ff780cd0", "comment": "Malware payload (Mirai)", "value": "9070dec4837f3399a2a03f129e75fb56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896852, "uuid": "9501ea33-407a-4730-becd-83e31050da9c", "comment": "Malware payload (Mirai)", "value": "e032f75ca262dea4ab1315f96c0714edefc97fe66ecabf96b504fa315b01d149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896852, "uuid": "b921c873-5e23-45a4-a3b7-e0f8bf4a4794", "comment": "Malware payload (Mirai)", "value": "f3eb0b902e64cf838ae6a39aef0a028c14126b48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771896852, "uuid": "cc03b59d-899f-4946-b01e-455c1640e210", "comment": "Malware payload (Mirai)", "value": "55dcae084265ca377d3c2803ce415c1b1ea2e06e90410c76f347cec29b499534a06893683704dde12f6a81782343e54c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896852, "uuid": "7cd98a3c-8094-4349-ac8a-7940e7b4cc70", "value": "T14113F12286ED6C79DF7508327D9486C5521B1ED983CA7763A430166581CA2ECB0BEB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896852, "uuid": "735dcee5-0c30-4449-9811-bf17f7903785", "value": "768:FRBKRCfn9rrI1RqHL+52gBWdEyTFojmKkBoVLkY8IT/JsKiZ2YFjOhyss3Uozo:rB5lrrGWS52CWy8fKhhwc/+KCjJzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771896852, "uuid": "b74c6e00-9d79-4351-b8b0-dbc21765c392", "value": 43360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771896852, "uuid": "14cbc6cc-e377-496f-9a7f-1d49cc3f9a82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771896852, "uuid": "76f91da6-edcb-4141-9c55-92452ba8d924", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb7843f-1132-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771904423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904423, "uuid": "8aac083c-b6b7-4528-ad4d-d80da3812462", "comment": "Malware payload (AsyncRAT)", "value": "0e9c109fe3dec939d727f7ad5424d266", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904423, "uuid": "68e105ab-7506-46e6-941c-b7cd0c90f575", "comment": "Malware payload (AsyncRAT)", "value": "e057341a509fb1ead00e2ecbdc0e8bd4b9d8690129c21e45d44ec6a32fdfd28f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904423, "uuid": "3eb8ec15-d288-455b-87f5-e9cf963f2317", "comment": "Malware payload (AsyncRAT)", "value": "55a431cd32c098fda87fc585d200ce0aec2b6ade", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771904423, "uuid": "3a2b7f23-35a8-478b-8ad6-bd8ce5266d55", "comment": "Malware payload (AsyncRAT)", "value": "baa5744b2ad56c0d0fd7564dbd97bc32a315ba2d3a1c3df6ac00ad51b41c4d20aa5b4780f79068aa7f5e4d6b7f521c2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904423, "uuid": "874cdbb0-d3e8-42c8-b387-b58c7268516e", "value": "T181763315B1E109E9E9B76139C2978951EBB3B8A70771C7CF23E852642F233F24935B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904423, "uuid": "7bf56c48-14ad-4245-bae5-34e946227f78", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904423, "uuid": "701f68f2-0a98-4fad-8b0a-79b94b6086e2", "value": "196608:xA1HeT39IigFeE9TFa0Z8DOjCdylukQVseiC:61+TtIiRY9Z8D8CclunQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771904423, "uuid": "f5ac5f4c-1174-469b-98ac-ce53a77d3987", "value": 7378066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771904423, "uuid": "30e9c37e-68f3-46eb-9c29-e75b25206568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771904423, "uuid": "92ba5ea5-c685-40ae-a550-68e25b3fc38d", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb115f1-114d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771916158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916158, "uuid": "18ec30a0-8af9-4335-98a6-a2ce3cbd74d6", "comment": "Malware payload", "value": "3c43e0d7d9311f4d65ba235df7159d14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916158, "uuid": "8f657b82-e65d-45bf-b11d-4f096732e32f", "comment": "Malware payload", "value": "e09e5fe705f2a31274e997ce0649f2c1818d7040828644e597b925b2e2033628", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916158, "uuid": "880d5212-8f47-4d5e-936d-d48412de3d12", "comment": "Malware payload", "value": "9550f1175d301b3babbaa54249cff7224905ecd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771916158, "uuid": "e29960f2-a20e-41a6-8c46-1f23123c31b6", "comment": "Malware payload", "value": "63889e87e1fe5c97ef3efc732095b266e3fd94858e0f5f3ef352a5841e2692fa63194566159fb05c6f44aceb32f71f2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916158, "uuid": "b6f2ff45-a5f6-4621-b986-5ddcd12f5d93", "value": "T1C623D70137CF0761D62C657281EB262053FAA7862E73D7DB7E4C47896E033B6AE41B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916158, "uuid": "4a0be030-2e61-4069-a5cb-287d17012b74", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916158, "uuid": "e0efff83-25c6-465f-9258-3008e649fb9f", "value": "768:hwUxbwVDV3hw3wXY2h3/XaDp7LeN8/92GsJ:h1bmM3wo2N/XaDp7h/OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771916158, "uuid": "6f3cf592-3151-4421-b161-d7967822b8cc", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771916158, "uuid": "353288ae-ee07-4c02-a7ba-298839120806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771916158, "uuid": "9bf4b817-ea98-4670-b886-63bc35642348", "value": "e09e5fe705f2a31274e997ce0649f2c1818d7040828644e597b925b2e2033628.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c546481-11b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771960955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960955, "uuid": "e1d8e3e7-258d-46b6-8fcd-99437b8639c7", "comment": "Malware payload (Mirai)", "value": "a41403fa925685d86d2812e77b2d9598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960955, "uuid": "074dbcc8-918e-4a23-84e9-4454e17b6664", "comment": "Malware payload (Mirai)", "value": "e0ab6c69b5ea1198278f9729b61450b5d685ba7a5d897d244c91d89a8d3f61f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960955, "uuid": "4a13b0ae-3166-4058-91d5-afce7f28f293", "comment": "Malware payload (Mirai)", "value": "1599df422dcc39900ca3c54dd654504a046f56ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960955, "uuid": "9b5fa1a5-210c-4bc1-a9e3-a111c7b58bd1", "comment": "Malware payload (Mirai)", "value": "84ebd0d6e2bd8aeaa0365745e0c6a34213352b39281cedee87f1287bbcf4dfb012dbc6e102e5983331a885b9cf6a0bb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960955, "uuid": "712ba14f-81c3-42df-ab50-6bf3e3aa1736", "value": "T14FF30A46F8815B12D5D112BEFE1D128E37231BB8E2DE72029D245F647B8A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960955, "uuid": "87609fd9-d222-4fc8-96ff-413267792463", "value": "3072:nPofEf6Uq2XpZ9XsAqT34EacFJsJebAgAb4:ngfrJ2/9XsTT3xaaZAgAb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960955, "uuid": "8f39be96-d4ad-403c-9075-d8d8cd904e0d", "value": 157532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960955, "uuid": "75644b87-3ac3-4030-88af-bc9bb5c7f5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960955, "uuid": "662ff196-6eb1-4c9b-bb75-29ea0b828ce1", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81145d57-111e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771895813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895813, "uuid": "dc18d3cb-5ffb-4c61-a5fb-4176ff9b335a", "comment": "Malware payload (Mirai)", "value": "5abcedbe42759b483ba3f521d4694065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895813, "uuid": "2e655e16-663d-46b9-979c-2d7aa4ca23a2", "comment": "Malware payload (Mirai)", "value": "e0b0b3f575296f2c5a224b94ac783ed88f47284f3ba47896ff4f2ec91043b495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895813, "uuid": "f41d7c42-1a0e-461a-8ede-16cd10b9844a", "comment": "Malware payload (Mirai)", "value": "cce2f572d3b9e2cde5ce918f57f6b4812ee5e4a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895813, "uuid": "761e02cc-04c0-451f-8f4b-9e3d5f415f22", "comment": "Malware payload (Mirai)", "value": "15d768a1d792f1a83b181155e9a77d0fdedc8f4d46823cb008dbf458eba5e2c07ac741aef56067fa4f7799689894b527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895813, "uuid": "9045cd17-7117-4c6b-8393-35d1ab823f00", "value": "T10B13F1B2D0035690EBFB56784D958FE433984AE933314F61F54B2BE7493B4099AB05C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895813, "uuid": "744ceb3c-bafd-4b34-93b5-d7a3c8652f37", "value": "768:DKj83tm3kIVLmpIe+ezZ70x6PFwIu32W5K9Kw5WP7mqINBTdPSqN42g1KFcgv4ui:DKutCL0L+ezuxYFgMEcWP7d2SqS2uKFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771895813, "uuid": "1ee25ae3-a9c8-479b-b4a5-f79768ae9c31", "value": 42472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771895813, "uuid": "2cf8fab0-0be5-44ff-83fd-31e40a4d0200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895813, "uuid": "89192a8d-78c8-4a7b-8335-c2f7c0a21fe2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d41f3fa-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937736, "uuid": "d17e43c3-2047-4bf1-871a-b2d9c5491edd", "comment": "Malware payload", "value": "46e6e7018dd6d0ceca95f68cca62fc4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937736, "uuid": "c03eced3-cee5-4e72-8064-55c4c5894e13", "comment": "Malware payload", "value": "e1df9d070c2818aee50805f0f3460731685e3763a784519697c23a4a4877417f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937736, "uuid": "e672d14e-cb61-4746-aaf8-b043ac1764c9", "comment": "Malware payload", "value": "3d3d0b72f8c2f0a65ed399c3c8986cdcd592e63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937736, "uuid": "fa476432-4dce-4101-90ba-5080ac0251e6", "comment": "Malware payload", "value": "d584df8e27f284d6ddf94bb5d1a4a5c7db703c38aff997823a2cb01595ea58e63553d3921ead7e3897e58b7bebce931c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937736, "uuid": "f1077fae-ea69-4db1-bb79-a707340628c2", "value": "T139C65B07ECA545E8C1A9D6348A669263BF717C494B3027D72B60F7342F73BE06AB9710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937736, "uuid": "f12cac65-6757-48e9-aa6c-1469829a1641", "value": "196608:WY17D7Pq0phc8jI7OpjE1Ut9xFld1lqB:WDEc8jIb6txTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937736, "uuid": "4effb797-5f48-4f69-8bd2-0569258ef721", "value": 12326160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937736, "uuid": "020a3740-5ada-48c3-9b4c-868160df5c83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937736, "uuid": "2915e792-8e1f-443d-96f8-998f52ea059a", "value": "mine-server", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f0643-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917502, "uuid": "3e08d7ed-1e14-403f-aa37-a62d0f24ca58", "comment": "Malware payload", "value": "a75a28d230788e47bf89440b6a1f0ff2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917502, "uuid": "1e509e8d-b9d4-467a-8cae-9954ae88160b", "comment": "Malware payload", "value": "e492201124d52220aa2b07be87eb6504d187e0458deaccec10c7918b5507fbeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917502, "uuid": "49276d3c-f5f1-46ba-b498-36113d9f4483", "comment": "Malware payload", "value": "722ca61bd9abebf2aeca125b8f219c6d7ad7f9db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917502, "uuid": "d1eb91b4-b947-43c0-9f05-206b3f19a108", "comment": "Malware payload", "value": "f7bed7e75f5b214160d676a00491af99e04a2cc8f16cdf4365e69de92a4f25caf6dfdaf1dff041b4feb91f0068c1fcbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917502, "uuid": "1a01c1a5-9729-47f7-9d43-e855a59f81c2", "value": "T181D3D81CD93719902E7E41EA20EF6DD2B07AEBB7609B6A0501A734EF4461B164BC4DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917502, "uuid": "35a8798a-9db9-47b1-871d-7bb2735247cd", "value": "3072:CPXZ7YXBosRSvL6J6VJLCVF1ouir3UzDCy5XU6EpMyzzyObpLdDl92OVAsLm5Vdx:EPfgp6X0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917502, "uuid": "819c63e6-8833-4d48-bbeb-26c928e0fa37", "value": 140920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917502, "uuid": "cbc3a6d0-945f-4083-a1b3-e184421bd197", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917502, "uuid": "21c48ca9-3882-49ad-93f4-4318736fb24f", "value": "invoice-1645080830.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13f8af1-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897693, "uuid": "e5f24bdb-ae97-4afc-a2fb-badb4e50dddf", "comment": "Malware payload (Mirai)", "value": "4ed362bafdeb62e06800359e0b1857f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897693, "uuid": "4dc32331-0a58-4707-bb37-95293fa7b12c", "comment": "Malware payload (Mirai)", "value": "e5d53a8beff502b464f121a77216b7ddbcfec74bd46e6980cf50e32fbbe0786d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897693, "uuid": "65d1004d-3efe-4a04-98ec-93d8385074d5", "comment": "Malware payload (Mirai)", "value": "77c98c64b5862058351e6b74e12f8f6292c57dfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897693, "uuid": "5f80ec5b-3e33-4892-b9fd-d45815b8b512", "comment": "Malware payload (Mirai)", "value": "e159e7d381b473483db5a930b68e8d6157a10e7e03c64c803746701afee641764e01f022947a81ddf8a6e336395960c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897693, "uuid": "2f613ca7-f4f1-4576-b741-5fbfa7676a2a", "value": "T140A3E809EF614FFBE86FDD374AF9070125CC551621A87B367974D828F64B24B0AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897693, "uuid": "241bf58c-260d-4abf-a207-c8e6b3ad6fe3", "value": "1536:QX2Sb7omV6ng6DH4XhnKi28Pi+Z9yIxrWwO/xT1BZlTXA9Udc5LI:QX2Sb7omM4XhKvwYxBBnGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897693, "uuid": "e0685772-c328-4a22-b87b-8536b7f368e5", "value": 102004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897693, "uuid": "48614f54-efd7-4364-82f7-56d340f9633b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897693, "uuid": "33b2dd5d-362b-4bac-a522-eeac0937a7ef", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581eb992-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917649, "uuid": "0a142ba7-6e16-4c67-8446-b34b2369358d", "comment": "Malware payload", "value": "f92891228a2ab692204500dcdc939fdc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917649, "uuid": "c57f2a06-a478-4997-a788-01e3885b0784", "comment": "Malware payload", "value": "e74f3b2e6f8c2ef43325c7ef7769d442b919a3c7291e474d4124f55b4425f751", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917649, "uuid": "0280f783-7c1d-4d5c-8db9-aff684b5fc10", "comment": "Malware payload", "value": "6bd62f0a2d449d85edf89bd4e8a47a3834b75676", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917649, "uuid": "0e94a0ad-539c-4852-9b69-b0483e223cc3", "comment": "Malware payload", "value": "93ad5598b95ef58c2d4dc12979af0344de5ea474d7414395c3caf62f0d47e69dc73124b5ce2ce17ce02c4b0d748d8df2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917649, "uuid": "2217e824-8177-46bd-9072-1885fe639a8b", "value": "T1BBD31A9FFA4767A5D80EB4FAA2733F69121E1E774496D069C2F016718203B49FB3046E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917649, "uuid": "3cf1757e-c98b-41e7-852c-a82619306807", "value": "768:C8m/Z6sZjWsYuSwnckNuRDh/X1jlc7AhQIfoA7gze+Vk+6yT9FsAuOuNxUTzyKTV:CPXZ6uSEYwF7pq4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917649, "uuid": "0b55befe-6e83-480d-b083-a473ae60ae9b", "value": 137055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917649, "uuid": "243211ac-ba98-4966-875c-e520863ed39d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917649, "uuid": "4bd0d510-67f6-4001-ac43-21a237aa6d92", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5987d456-111a-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1771894029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771894029, "uuid": "fc6c117b-6bc4-4c32-8b3d-7682a5dc4062", "comment": "Malware payload (DonutLoader)", "value": "21a74e3c98906689f6d54d3eb72ec9f8", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771894029, "uuid": "511e6149-516c-42ee-a07e-a17c725e86e8", "comment": "Malware payload (DonutLoader)", "value": "e7acc171f303d8c399f7e01f0091fe0e6253b8f81c6e444ec644d57463462f9d", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771894029, "uuid": "f0ae0c41-234e-4752-81b2-03fa1198d92b", "comment": "Malware payload (DonutLoader)", "value": "dbcfcfc303d3196d22109206a093ec82ac3e56c0", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771894029, "uuid": "6a592f45-7315-43ad-8540-4da49133c626", "comment": "Malware payload (DonutLoader)", "value": "4c1c40775ed884460cd8330ee0dd8a3c9925a97a7de0b86905ff2275ca1e86d36d658f5acbf2fc639418ab60b2263b3d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771894029, "uuid": "3f1e115d-a1e8-4cf7-bf92-895231306043", "value": "T18E36EABB8E384C89C6D7F1F69381D6700DE6AE67A4E6E0FA51D209401F437106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771894029, "uuid": "bfac72b0-228a-4f2b-bfe3-c7ead7f73191", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771894029, "uuid": "b0ffd590-2379-4070-9cf5-d290048f9c19", "value": "49152:hmoqRlHGwfbwbE9ofqNPLgo2wV3eo8xw:IQvwV/8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771894029, "uuid": "9a85752d-096f-4b49-8996-cb5e096dbd15", "value": 5120512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771894029, "uuid": "d0b930c4-069a-459c-9f9d-5117edfae7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771894029, "uuid": "1f397664-f80f-4890-a9a8-1f51c0815cef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28822077-11c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771969109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969109, "uuid": "7a426e79-01d9-49d1-8286-17ef6a46a550", "comment": "Malware payload", "value": "3bc9213662408a45347ff3b9fd85953f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969109, "uuid": "a75ee9e9-e6aa-4316-84f8-71e703b5eaeb", "comment": "Malware payload", "value": "e8b7ced1b04cb3e97a2667011339f3e8ae4bbfba9065d25ca02997b22e687f2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969109, "uuid": "3dd9fb18-b7ce-4824-9373-89e21187826e", "comment": "Malware payload", "value": "5d4242a3c3b6038b8aa3d9b7d62966657619b62a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771969109, "uuid": "2f679f48-d9c6-4783-989a-f3be079e5876", "comment": "Malware payload", "value": "942d0185d85eefbef67c2fe60b75f17a9169cdec592b290b8b496f5d0cf891b10e6c3f48b11fbcaec472cee1dc45bbe3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969109, "uuid": "27f3b1e1-46a6-417b-8c9d-bef5d5f097b3", "value": "T15DE6334A8C5FDECBD9356830852E3743393D915D0B0AAEDB67A593FA4FB6780CA67040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969109, "uuid": "9616d700-f59a-4077-bec7-7245350dba75", "value": "393216:MN6jG8vbOR7volku+7KNWs1Vea8nJS+PXUsNi4vw53zrBneMG:yDRzolkbKcs1Vea8GABw53dTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771969109, "uuid": "58506f84-69cf-4bf5-9826-bbaaf0a57de7", "value": 14799941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771969109, "uuid": "89a8be09-666d-4a30-b8c6-048f0183a736", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771969109, "uuid": "0dcf0578-3d3c-4ee3-8a1a-bb40b646ab5c", "value": "Atlanta-Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfc0f6d-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919427, "uuid": "984ac7d4-8b16-4e61-98ea-5063877f85c5", "comment": "Malware payload", "value": "e2d605c5a2812621923d38acaac521be", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919427, "uuid": "0e3bd511-f871-43fb-8307-565cb0508b1c", "comment": "Malware payload", "value": "e90eef10534b4e386e9bf4c65478f059a79b0f2ed2ef695f372120350906480b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919427, "uuid": "4a19b033-11f3-4a62-ac6a-57d98330854e", "comment": "Malware payload", "value": "688cf27c760132ca0737b2a9f466e4828c927562", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919427, "uuid": "f8ba8446-678b-4c45-93b3-4f0c94a5438e", "comment": "Malware payload", "value": "52fd38370e651969c2a1573c4f63880dca91cd41d768ed0454129e606b1c93347365b5943bdb67e0500bcfed504ce3f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919427, "uuid": "55b21e00-3bd2-4836-800a-2eac001a4a76", "value": "T10CD329D8DE82F9ADAD7414053DCB1A33D601AF66FE82CB642C3D81A0EB3415E85599FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919427, "uuid": "dfa26491-6c6c-4441-a252-4e412c06713f", "value": "768:C8m/Z6sZjWsYuSwnckNuRAZ8ZmZuZPZoZgZAZnZgZxZZZ+ZUZCZhZCZQZuZnZIZv:CPXZ6uSEY5Fspop54YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919427, "uuid": "f5fbd842-9f98-4b31-811f-fa07693243f8", "value": 139933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919427, "uuid": "ba9405bb-8ef1-45d4-8008-357186adb085", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919427, "uuid": "e54d9468-19c6-44a1-b4ba-df498e30245a", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b595035d-1168-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771927684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927684, "uuid": "467c70bd-2160-419b-97b2-709c1bc58ceb", "comment": "Malware payload (PhantomStealer)", "value": "d1ca9201aebf103ab5e2f0b429605240", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927684, "uuid": "0aaa620a-e626-4033-9f21-1f69bf03bc60", "comment": "Malware payload (PhantomStealer)", "value": "e935fdb881e23101a3bb886d69688f29de0fd76cd4ca81a548d05601a3d5a464", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927684, "uuid": "bbea4987-15e7-4ea3-aa09-e2dff8a840be", "comment": "Malware payload (PhantomStealer)", "value": "576faf7670b4b0f4070ecff0fe0c9bc3a0c4a473", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771927684, "uuid": "dc17ed72-82ce-4f31-bec2-49be1fdfb394", "comment": "Malware payload (PhantomStealer)", "value": "ab3f297395b9c2cadd77784912a24e87be82fecf85412c3810649449115ee9550ebf3acbc85c8273f32958f2ed5af497", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927684, "uuid": "cca531d8-a1ae-4d52-bfe5-945fbc06dfb3", "value": "T1272384CC3EC2B566861264333A2FE49BF17F0C85F68CE594C3667854F8A8B18D53692D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927684, "uuid": "c2d8fb5a-7f60-493a-941b-6a6b40dda22e", "value": "768:EUxCghdWGFnjvOJM8eJ1/aBLTpE8U11JBtueM:EGC6WGFnrOJM3J1ktC1PBgeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771927684, "uuid": "6647035d-8098-46fe-8e85-16e9f554a569", "value": 46823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771927684, "uuid": "69d3e4fb-2f11-455e-95cb-17476775bc46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771927684, "uuid": "e3f638a2-01e4-453b-8dd8-ec9027d4d54a", "value": "1219110570920132.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51088aae-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771952426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952426, "uuid": "9d2ebbf5-f374-4255-84d8-43d279714b4c", "comment": "Malware payload", "value": "483babce35b6e1ed8d01cc8723662f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952426, "uuid": "e0825ae9-6863-4da7-adf7-670d74ccf24e", "comment": "Malware payload", "value": "e97f6cf689ab4ab4c547ac7d3cb6f37850eb2ae8c7d2b099028fcedbd8d722d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952426, "uuid": "1f03f743-2e8c-4b8e-b320-b4d8677dcadb", "comment": "Malware payload", "value": "e00feed02f6adbc1bb5a93e044ed1c8991fc5ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952426, "uuid": "5652e252-77d1-4cb8-8cef-68722448ff95", "comment": "Malware payload", "value": "972aae6c0a3aad54b2dc397ab119355bf850c47eb66941d21ce2a1620e5705b7e1e38fdf2b8bf2b1325dfac27a450b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952426, "uuid": "d619813e-863e-41be-a386-b1c53e4a74b4", "value": "T1B394F612EB5074A9F89345B02D78A256692D3D3A3641EC0BB78E9F4A3731983B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952426, "uuid": "adc4acee-f6fe-4405-a7fe-fc5a00c56668", "value": "f1649b9043abe60ca52334972036f48f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952426, "uuid": "b5c63652-6565-459c-82dd-f557c5567da7", "value": "12288:gZLy+ESbwSLH+5bRIlCa0fJXIfkFPHGQRa65s/:Uyw6qfkFPHGQQ65s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952426, "uuid": "2684d893-590f-4505-b409-b556136d05d1", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952426, "uuid": "2f18ac7c-2f83-4dbf-aa98-15626e6fd451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952426, "uuid": "b06be5ad-ba72-4143-99e6-00195b84609e", "value": "Documento adjunto y detalles de pago____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8c0724-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771952638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952638, "uuid": "c9b95e85-ff8c-484b-8494-1ca862d86317", "comment": "Malware payload", "value": "823a9143613e9a107edb337214f1942b", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952638, "uuid": "d2d8d5b2-b287-49ff-8634-f5b9c23b3ac7", "comment": "Malware payload", "value": "ea078216452f5f6d4eea27bbc062286396a5252e2c267ecc3933d05a4e38da15", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952638, "uuid": "3c356c24-ae97-4b96-a791-1b5bb32ec038", "comment": "Malware payload", "value": "2e0ce250f5507388c8c31b607ce4204459e0a106", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952638, "uuid": "672a0852-13de-4b27-86ef-ee42faa966fc", "comment": "Malware payload", "value": "ece976cb71746dfc37290d51f2665ad27ad79b4d1b1e1ffa93821a029300431235074f5bab9afcacd9808d5ff1f0b83c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952638, "uuid": "a5ff324a-aa01-4784-aaff-5d8d38e70527", "value": "T1820458996A5D4AB573432C642C27F3CA7674DB7BB320AE3DD5360240905E3A807F6C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952638, "uuid": "9ed288af-63ad-4a15-bbf9-7a708488e1a2", "value": "768:E2bK0ZFQW0paHX7O44444444CEka+Cui+NuQ:PEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952638, "uuid": "156a6abb-52bf-4063-b588-ab780aa33ad9", "value": 173710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952638, "uuid": "71aeefc3-dbcb-46b8-b6f9-41e25415af8d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952638, "uuid": "6d914de4-fd64-4f51-84fe-8cb31e73393a", "value": "design.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff61e8b-1180-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771937768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937768, "uuid": "c994110d-bef4-4024-a33a-f4cf357a6c77", "comment": "Malware payload (CoinMiner)", "value": "9637bab395a48698cd6eea3e58c4461d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937768, "uuid": "8c97bf09-6d71-420b-b583-8831e3e2e67c", "comment": "Malware payload (CoinMiner)", "value": "ea382f4b7a5ebeba505e56d42046a420f23a9a126d868bebf3ca04a67cb241bd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937768, "uuid": "301612a6-b0be-4f63-a36f-c7cf1ad9ca7c", "comment": "Malware payload (CoinMiner)", "value": "25e82563388fdf57c90f323710a20ee4a33d17b9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937768, "uuid": "e7c76212-f88b-43d5-a635-3ba2c5d363fd", "comment": "Malware payload (CoinMiner)", "value": "9a878eada1d853ff3b762bd01280c50d1f39345c90d63aa272ef2ff532c4e390cb74c8ac2fd9fbf4dc952946bd28841b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937768, "uuid": "101eb809-d9d1-4e3a-8aae-6d883232338a", "value": "T1C812D80A61D421F486DB8729EDCB53E9796E047F010F1A5072BD82816FB5A3D8BB93C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937768, "uuid": "660fcd76-99da-483a-b3c3-6d7228c859b3", "value": "192:RFh8NCuBhlL8DHiQZbvL++CY0IAFbk5vS9so2RmmJUtp:RofUPbvi+p0Iabk5qOo2YMUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937768, "uuid": "3f855912-68fc-493f-a3a8-c19c4ab02a49", "value": 9049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937768, "uuid": "aba85289-373f-4958-a2de-a6772f56676c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937768, "uuid": "2b22882a-6fe1-4a3f-ab4c-19588157ca5b", "value": "silent-deploy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa46a9d-11a1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952281, "uuid": "695090c5-d1da-4ffa-9a6c-eccbb974fae7", "comment": "Malware payload (njrat)", "value": "4417edd618a29c6ade4ebf32fe39b7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952281, "uuid": "4e3de774-7aa9-47dd-9c7a-20623d8c6e4f", "comment": "Malware payload (njrat)", "value": "eaeddaea3d4432f6235b4e3f4e59e14249782f890f1888890beea295542a249e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952281, "uuid": "0a7032c7-c654-4b44-983a-d0b72f4956a5", "comment": "Malware payload (njrat)", "value": "9121925dc8ae02bbd455bd26a91fac26c4e163f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952281, "uuid": "e897b846-4485-4fac-acf9-f9939de60d82", "comment": "Malware payload (njrat)", "value": "e05690bbd8d441de6150cc851756eb6382939c43813963e641ecfa5bdbc4ef81b24c474500a664e021b6490d5d969027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952281, "uuid": "f0b29ae7-0b01-4474-b4b6-1f931fbe6a68", "value": "T10B93E95977E56524E0BF5AF79471F2004F34B48B1602E39D99F218AA0A33AC44F85FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952281, "uuid": "fa2ad50f-2378-4670-babe-4e82dfff38ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952281, "uuid": "56c3eae7-691b-4c26-bc6f-8821dbdaad6b", "value": "1536:i8yQIBlfGQFk2ZonmzlMxjEwzGi1dDDDSgS:i84tFk2ZonmZMOi1db3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952281, "uuid": "a1cef539-4f18-4ebd-bdb0-4e549a90aed8", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952281, "uuid": "3d7478ca-a69f-4597-a304-c0f9a060fc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952281, "uuid": "4ae50054-ab18-4a37-96a5-113e45bea1aa", "value": "mdmayupinyahowoqwq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439a5424-118a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771942096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942096, "uuid": "32b3ff2a-5591-410c-b90f-ca4f7814f552", "comment": "Malware payload (RemcosRAT)", "value": "31cc0944def77dca99c02461be1aa2fb", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942096, "uuid": "50949ba4-0961-4046-b1ef-b3101edf14d3", "comment": "Malware payload (RemcosRAT)", "value": "eb729558ea538dc678e67eb63655e55008c40e4fcce95091e81e9321e700fdca", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942096, "uuid": "299572c5-4934-4f4f-92f1-9df4de85046b", "comment": "Malware payload (RemcosRAT)", "value": "a301bd8f3cf8ed3d55019294b6c664455012746e", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771942096, "uuid": "c1950b59-fb13-4ba3-b4a0-77a4881d7e14", "comment": "Malware payload (RemcosRAT)", "value": "a966fafd9bf3716bdb4c8a5ce56b03906a0e0b31bc44c053bc180e0cc7e4eee9cad6023f5c91a289c2066217037b73ea", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942096, "uuid": "2a72fe1a-5304-4272-a281-776de83c1054", "value": "T1643516BC9A320A8152094EEACDE07581D99F88573957BA1CF20BE7DDE5FD625400CF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942096, "uuid": "b161a2e2-da97-438f-98f4-cd949727abd1", "value": "1536:uyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyc:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771942096, "uuid": "0aa65844-f025-426b-bc43-592fc0f032e6", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771942096, "uuid": "76a49f34-bcae-400b-82ed-e72fa91070e7", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771942096, "uuid": "121980b0-c83f-4431-966e-6b5eb672d2d5", "value": "Productos de maquinaria.Doc.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178495db-11b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960920, "uuid": "8b21e80f-521a-4797-b866-2f883069647b", "comment": "Malware payload", "value": "8764364245f06463998c0e82634b166f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960920, "uuid": "ccc8e25c-71e9-4108-ab10-f0941d362850", "comment": "Malware payload", "value": "ec0dc8be4b19bd19d26ce264e0be5b42fdbc08ad5d39e2b1429581a00c8540f3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960920, "uuid": "2c51ecf3-52f7-486f-82e1-c6717a4c3bd3", "comment": "Malware payload", "value": "0e089b5c41561fc2dd1000539c556fd1f287bcfb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960920, "uuid": "f4f5ec48-0544-45b9-ba5d-7ddb72e53d0c", "comment": "Malware payload", "value": "b65cb4b6651c3c463f098ca33e3249ff8d234d0467bf0c8c62c86f4ea91f0401a097f1630d8eae2c5c18328d64772144", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960920, "uuid": "159a0645-4f71-4d8e-a5f6-a5ab2bea9186", "value": "T14DD6330ED6E522EDC2629038BFC157F0B4B9B8742772987D97A8D7316CBB131C41985B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960920, "uuid": "4661efd4-ce5d-4653-9cb6-89d80ddfdf4d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960920, "uuid": "79c4e3d9-1985-4a48-9590-118f1ddfe199", "value": "393216:UXuhvBTuXrTs2oj8BXMCHWUjXecuI3/PGTAI:UXM03s28iXMb8XTH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960920, "uuid": "9aaba09a-db02-4fcb-ace5-15edc71b1f21", "value": 12620424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960920, "uuid": "93213fe9-c8c8-46fb-b2ff-3acbf990530e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960920, "uuid": "8a7e832b-4a5c-40f9-8f01-98fc0e3705af", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b440379-11bb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771963073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963073, "uuid": "b72583d0-93bd-4d1a-bd12-913c9a9854d7", "comment": "Malware payload (AsyncRAT)", "value": "f5640f2bca2a37bb68ea35109d8749a4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963073, "uuid": "01f752b1-2788-4c66-8006-64c11b43944f", "comment": "Malware payload (AsyncRAT)", "value": "ed204e5e65d5ad76496dd2edeaac94645915ec52953f669afbd2ddeac37e3b19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963073, "uuid": "30c21b13-0a51-44d2-8f17-941697e951b4", "comment": "Malware payload (AsyncRAT)", "value": "26e078d6bbe9707ef3889cd382135bd6c9a96e9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771963073, "uuid": "7dcf61b7-7d09-4f8e-bb0c-15b8b793a262", "comment": "Malware payload (AsyncRAT)", "value": "4b749ac02d1869a5b4a39d6dc93745b1707590f9a02af58ea5fa0e415f37ba5acabc527e0659131e4c6eb75e52d437fd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963073, "uuid": "2b8cd183-4e13-427e-b933-add368eaf8d2", "value": "T177F24C083B944225D6FE7FFA6DB371021670F9079913EB8D4CD999AA6F27BC045043AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963073, "uuid": "aa4f004d-6e44-4734-abdd-dd6d2616f0f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963073, "uuid": "fcb9f703-12a6-4fd7-8759-efb0b4118a1f", "value": "768:XKLJau6SW06XnLxcOMWbFJ9Y3cOMh13xzN:XKlautWzXLVMSFJ9YsOMHZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771963073, "uuid": "5228fdfc-2af3-4752-817a-b2673c34414f", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771963073, "uuid": "f3842e2d-3508-4eca-a1bc-fd32ff9bbf14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771963073, "uuid": "3e8e5c0d-32b2-4f59-a58d-5b0ca4a8fe44", "value": "ebukaxworm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c12847-1129-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771900675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900675, "uuid": "9ff56474-b6fb-4bb5-b440-165757ef3882", "comment": "Malware payload (Mirai)", "value": "04a7ebea5597e6396cb78837a003f893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900675, "uuid": "c5105af0-091f-4af4-a4a7-dcddb5803c7d", "comment": "Malware payload (Mirai)", "value": "ed5290853f112ae7042a35cd55f68fb00eae0c92da312b7b984bfccdaa21160a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900675, "uuid": "bf4e5383-3ac8-4ee2-98e6-e49a7941c06c", "comment": "Malware payload (Mirai)", "value": "0ef60ffcb6233431d2e248a9fc8e1971226286c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900675, "uuid": "75a8db13-55b4-4f8f-a9bd-205e58559d90", "comment": "Malware payload (Mirai)", "value": "ecff478a19c705d37566723d225ed0a91395ccf7e5e821fc257716e619eee39f9a81f622ffc4fca613fdac77d715e8c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900675, "uuid": "0d20226a-bd05-4dc1-8f8a-60a87daf1ed8", "value": "T12B23F279B695BCB64FD23E338529104AC6287FF4C675301295704BE8A3E7119AB9C1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900675, "uuid": "16cb0721-0ab9-43ef-bd6c-49496915d3ad", "value": "768:SRn98HoEZiiDq8+T1l3RlRyJ8JPyfZBOjsBd2WA5jIKQwd9q3UELjG:StKHVq8+T19O8WZ0jCBULQwwLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900675, "uuid": "34022e4c-d46b-47ff-a1ed-c6455662d77f", "value": 46440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900675, "uuid": "3c8b3e04-9ae2-45bb-9bb2-1651894151c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900675, "uuid": "5b851053-9aa9-411c-a749-9c1911b4020d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcf53ea-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919588, "uuid": "f4c4c7bc-d5b8-4f48-b7c0-f60c975a9e41", "comment": "Malware payload", "value": "883fa5e1714849bf786ed2d44d86ffd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919588, "uuid": "98a31d45-6189-4cfe-bafd-1726e377023d", "comment": "Malware payload", "value": "edc7c1d143fb149329981885f43182d71c5d1675ccc079e7e0b35ebdc43a13b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919588, "uuid": "07726b1a-1f73-420c-be45-4f054f85dda1", "comment": "Malware payload", "value": "0ba897aae90d35b98850e0519c8c5f2246ee8b10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919588, "uuid": "a612930d-052f-48a2-9dba-2089dbc54f32", "comment": "Malware payload", "value": "e424b7501f7b4007b6578dd18179cf404c94d609ad22e815d3c3f55bdebfd38a4f68f6967cff8289ba54ff6fb3962890", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919588, "uuid": "0b5d20ca-8429-456c-a531-0ceb2c6e6747", "value": "T190D31A7749A71F6717671CC8AE7F090398A08D0BE86C09B47919AB7740CD0F79963B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919588, "uuid": "3cc99d1b-6186-4897-a9c1-7c15d78a80cd", "value": "768:C8m/Z6sZjWsYuSwnckNuR78dgCF9Lp0AXxeLScFYHXwz04mYF6F2r:CPXZ6uSEYwdFVpR4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919588, "uuid": "f020bf7e-7bba-4ef8-9280-639aa2c9404e", "value": 139949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919588, "uuid": "81ff0528-fac9-4c48-ae32-c7dc333f2a41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919588, "uuid": "e0c0b44a-b605-41ac-9a5b-7565652c24d4", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc4a046-11a3-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952875, "uuid": "e71debc5-cd43-4d7a-8838-35524a79694f", "comment": "Malware payload (njrat)", "value": "20d6a2e136dc5dbe94aa61f294216ac5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952875, "uuid": "a586deb5-e99e-4b24-87cc-a2d8a56d95d3", "comment": "Malware payload (njrat)", "value": "efd892cdc9725d3d232aeb88bf14af0d442bdc4b87bc4e349a008e05eaf49561", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952875, "uuid": "c650538c-83f7-4b98-b3c3-f58a5b589e99", "comment": "Malware payload (njrat)", "value": "9915cd50b42ba0be42027fd1f36790e1a4730484", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952875, "uuid": "b5632abd-e892-4701-81c7-cbc292165a1d", "comment": "Malware payload (njrat)", "value": "33192846e55d1285d71a71163c6ed0ae685300d077cafc71324174b32b7ed2d4de250cbe9ae95e7d39b0e56ecb708c1b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952875, "uuid": "e5df14f0-ea81-44ce-a4cc-b71874c1928c", "value": "T130F6F08854BEE80AEE8581F7E90769C7E6C5698FF5E9CE9F002D3A6B0CD1E704B75104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952875, "uuid": "e9623bb7-629a-4fd9-b152-25757e4555da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952875, "uuid": "ce32ba47-7caf-4ba5-b813-e2fc27c107d2", "value": "393216:Xj+7bt8+l5ngy4L4yzkCCKhfkmsrV8uz2MInetgWlsefS3+nQIe:XjK9l5S4Y1CKhiV/z2ZB0W3+nQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952875, "uuid": "7b5f1663-c859-4d1e-ba46-b5bed35a3dde", "value": 16444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952875, "uuid": "78bb6f77-a684-48a6-88d3-e802a56d542a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952875, "uuid": "a3a5f8d3-ac9e-43c7-b56d-082a815358a5", "value": "njRAT0.7dHorrorEdition-BIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0da1399-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919569, "uuid": "6faeba8b-a8bf-42af-9ad6-a652dd698d70", "comment": "Malware payload", "value": "7cfa5e33cb93b20159ce8665f7a5cb0f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919569, "uuid": "ee0defe2-403a-4580-9d38-6d6ff7b65fc9", "comment": "Malware payload", "value": "f0504f2e99ba5162646c330e951aa2e6cc0b906f02c44b1efb9c54716efcf536", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919569, "uuid": "07e8f60b-86d4-4ff4-b39d-554ada0adafb", "comment": "Malware payload", "value": "6a1bedfe528daec8f9b044f768b48df9d8bf8052", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919569, "uuid": "e242bfd4-6cd0-4e70-a836-34ba130c0a6f", "comment": "Malware payload", "value": "563bb110fa86d16957730570f5fcd059593daacf63540f8d470f68522b4ddd67b00c9380bad944a531c76468444e23d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919569, "uuid": "b91c9546-c8d3-440d-ae42-0ff88d5625bb", "value": "T16BD3088C1A2465086481BF881B153797C9FA6B342D8558DB937BFBB2F7D9E310493EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919569, "uuid": "00c1dfe3-69d9-49ae-8872-aa1e0bf3ebda", "value": "3072:CPXZ7Y5araHaCaDaUa3a8auasaAazaqa0aQaNaba4avaRawaLa0araLa/aPavaXO:E4MpWX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919569, "uuid": "6081ce88-c80c-4dba-94df-88e74005abd7", "value": 135213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919569, "uuid": "7f7fe43b-1eff-4830-9d4a-576bb988709f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919569, "uuid": "e7945794-e644-447b-aefa-199bc022e099", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb508e1c-115e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771923479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923479, "uuid": "4881dff6-2c93-48fa-8f54-5e93fbdf79df", "comment": "Malware payload (AgentTesla)", "value": "1848a6d9c5497510b17503424318d91c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923479, "uuid": "25f33fec-a9a7-48f4-bf40-fd7969bf135c", "comment": "Malware payload (AgentTesla)", "value": "f0b04a570f75d42e89c370b5083ce05bc452e997f028eddf8a283bec93f9a828", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923479, "uuid": "f203e143-e17c-4e4d-a9d5-41ce58aa689e", "comment": "Malware payload (AgentTesla)", "value": "60d359989efc821617a4fb9177fa205a32e513f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771923479, "uuid": "6725d6cc-40b6-4f43-bbc2-4936d9dfe26f", "comment": "Malware payload (AgentTesla)", "value": "668609df4dac145bbfbf4508c146f4baee6ef84724d5419359bb0b7ab16444ac6a685edae99371cca34c1459e912993d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923479, "uuid": "6735c1ae-8b35-405a-a738-29b5b4d27e75", "value": "T1372502186A27C913C4550B3556E2F27457B84ECAE513D31B8FECBEEBBA13F564C84282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923479, "uuid": "9d44996b-6f30-4276-bc43-276b23bb922d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923479, "uuid": "f4de3aed-ea24-4155-b5b0-49695a4528c0", "value": "24576:TLjdIUqlrExZWFggVrVrs5iDyE44SqOxoNkXgHhd:TLjxqZIOggVHDyV4SNokXAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771923479, "uuid": "2ab1d76e-8eb4-40b8-af79-b278c1c766a6", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771923479, "uuid": "5bce4052-1cc6-48e4-90e4-503350875c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771923479, "uuid": "0867f784-7abb-4215-9964-990ec6103fb7", "value": "SecuriteInfo.com.Win32.MalwareX-gen.46984322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522494be-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919357, "uuid": "2555c5e9-bc8e-447b-9f8e-65b55f589e63", "comment": "Malware payload", "value": "ddf1f0ce07193176b09f3a6684f8cac8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919357, "uuid": "21191f9a-8701-4dc3-8b5c-0b57a74159fb", "comment": "Malware payload", "value": "f0d58de51053eee78dc872fb0a86c99ec68c5d49efce3ed6a831dae2a23dd77f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919357, "uuid": "40b9ff48-5e66-4538-8679-2291c3810687", "comment": "Malware payload", "value": "fbb957d5b6c5527e1d7c55d6af0dd702e6c67742", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919357, "uuid": "879af11e-9452-4c3b-b63d-870eddf40b07", "comment": "Malware payload", "value": "8206e6c631b91816c19a699c319c874da85a86c5a6f071840d3202b9aaa2da166f92aecc5fb597456b86962151b5e1e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919357, "uuid": "1d9776a7-afec-4f80-96aa-f15295e30058", "value": "T1CAD3E926E863B3346925373CBB42867B232B8A78180D8F2315794AF319F6753479F5D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919357, "uuid": "cb7ff526-ac33-4379-8b62-818db237bf0f", "value": "1536:CPXZ6uSEYJ9YwIEhROJ0UWiUAZlpA/p9IVRpF/DrU77EqSVMIZVLIH5WTxIjIxdx:CPXZ7YKpQX4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919357, "uuid": "0979d428-82b6-4c46-8e89-578693617fa2", "value": 136994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919357, "uuid": "bfbd7d2e-a4e8-4bfe-a8bf-9df5c88bb4bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919357, "uuid": "e82344bf-8790-4a22-b005-a12792bf92c0", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61baeb38-1131-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771903921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903921, "uuid": "c043f5d7-18ef-44fd-8300-dfb39bd782a5", "comment": "Malware payload", "value": "842763c24a7ad7523dce08d710034ed6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903921, "uuid": "d2580862-3e1b-4e18-9f8f-06fd330a1821", "comment": "Malware payload", "value": "f10d925cfd82720a15ae5ac14f5ec9f3f5cba9fff63732f6602561627ee2e3f4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903921, "uuid": "03b358a9-84b2-4ac0-aae7-8f40c826916c", "comment": "Malware payload", "value": "4d42c8ce801fa170412aeb4a53de8c2b836ffc83", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771903921, "uuid": "2fab96f8-27cf-4887-aa99-d1dfa5ef7432", "comment": "Malware payload", "value": "0ad90f2bfc40d4065c168877ac6c5ff5f446f72485db1d95dba902dd922201517c80c416326acee29ea9aa0b4baf226a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903921, "uuid": "1f0b646d-a52a-4be2-8aaa-c2497d8841ff", "value": "T19757332F63614121E76067B7E62EF4E1E3402391DD59A6B35105B2F213E70AF4BCE7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903921, "uuid": "bf54ba78-0038-43fe-beb5-33be7519de7f", "value": "786432:VKZzKe1MXiTsySZjOb0S/OqIycKm6XcVr4LZz/KjKpFEnOT//H:VwzKo9sDjK0NK/cVr4tz/npFEOTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771903921, "uuid": "d957a94a-3a4a-4700-b2ec-1f61d5a08ff6", "value": 28661166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771903921, "uuid": "4e9345e1-84e6-41c7-ab5f-1c0d5211e8d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771903921, "uuid": "4455fadd-eac7-4b1e-a494-a3da4fc8f949", "value": "Vilonity 17.02.2026 (Password 123).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1086854f-11a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771955324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955324, "uuid": "14e8e7c2-61b9-420b-a247-d7790fbc4aef", "comment": "Malware payload", "value": "1c54c529cad3e5b21c423bf52292ac7e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955324, "uuid": "917eaedb-45aa-4868-84ed-94a1fef52c43", "comment": "Malware payload", "value": "f18ca736cb3fa54a455b9a3af8445af90d5c60eeb540f503807b691c046c98f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955324, "uuid": "2ef1f246-4a95-4e48-8f82-4e668b568b65", "comment": "Malware payload", "value": "e555c3c71a28ec7e0f3cd9154d212091c5343317", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771955324, "uuid": "0533cad4-f3e5-4c01-b2bd-250494538d4f", "comment": "Malware payload", "value": "91461e6a5be39ab189fc727ea46316e561b3b3d52adc5f5adf38c8e58e637191172fd49834ddcf816f689754b1636640", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955324, "uuid": "876ebd3c-5bc9-493a-b5e7-b8f784ba6b62", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955324, "uuid": "e53b1e36-c1b9-4543-af00-8767de13c19e", "value": "3:mKDDroe/n:hnZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771955324, "uuid": "cb2f27b5-7fb2-43af-b7c3-4d695cd24afd", "value": 24, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771955324, "uuid": "2ca4a84f-515e-4e46-bb4b-17249b085232", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771955324, "uuid": "fadf738f-c17b-44cf-baeb-03a140ec12d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402f67c8-11ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771962706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962706, "uuid": "a3c92b73-50f9-4bb9-934b-c3da78000e63", "comment": "Malware payload (Gafgyt)", "value": "cec5bd5773191f14be147c59b016577f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962706, "uuid": "b57782cb-e046-4849-a361-37710e25ecef", "comment": "Malware payload (Gafgyt)", "value": "f1f29d1c9f19aca0eaa2fbabc3a0d987a74d925388451e6abafa0acc0f676016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962706, "uuid": "b187edc8-3a57-4bd7-9bb0-cdfdf2c37fcc", "comment": "Malware payload (Gafgyt)", "value": "526eeccbcde8e744f59cb8de2a22856a68b1382f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771962706, "uuid": "c25265d8-cde0-4e37-8b38-9f022b65555e", "comment": "Malware payload (Gafgyt)", "value": "9593a105dcd92951d3140fb4bcae9777bb22f160d28ca4ac11b3382acfbbe6ab13860037b3049248e5a9a8ebf5e3f650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962706, "uuid": "b60c1aca-e706-4488-a51d-7cd4f542d11f", "value": "T1BED31905F4554763C2C31379B68E5A4D3B221BF493CB7312B634ABB42FC279A2E29D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962706, "uuid": "54bde1ca-b1ee-4c2c-956c-2176cff8729e", "value": "3072:CRd/mEaLDVVg09ay1ltp5hQ9Gim6IPAmfQNY5oaCx1n:A/mEaLDVV7tp5hQ9G/AmfQNY5hCx1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771962706, "uuid": "30645963-546d-40da-99d8-4ce1d2aaf555", "value": 136134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771962706, "uuid": "488b3a9b-8d9a-455b-ba61-404424895bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771962706, "uuid": "265a9cc0-b72b-48fc-9808-e8a0928d781e", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb822ab1-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917386, "uuid": "24a84275-563a-4959-ade5-96f7eeaab6bc", "comment": "Malware payload", "value": "88ec4ef17ebf3ed95be0379ce6acb392", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917386, "uuid": "ca9f15ec-0d27-4999-8e46-16562408e4f9", "comment": "Malware payload", "value": "f2c3cef3f469549dc34dc55234a2431857ac61a8549a00616f8a622fac4b0139", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917386, "uuid": "7de3d606-f3ac-4e02-ba6e-37c96f0d4711", "comment": "Malware payload", "value": "791c882754d1c0f315790f6c29234509e8b0ce4f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917386, "uuid": "9561bf48-c460-412d-93a8-c958832a6bb9", "comment": "Malware payload", "value": "00cf4dec4a975c8b413b8fac72cb115f2d749b3f72e2c611e0d13170dea995fc0868b66981476be5c74bea82d83727dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917386, "uuid": "d77b11bc-2a29-4c46-8ee2-79bb96350fae", "value": "T1A4D3FA0C873EE1D871553C90E3AD1288083AE7B5B02A8BD163FE84DCAF5DD16977A917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917386, "uuid": "2c9fc774-a97b-4f0d-805e-aca9766cd354", "value": "768:C8m/Z6sZjWsYuSwnckNuREF4r4rjp3BxeLScFYHXwz04mYF6F2r:CPXZ6uSEYEF9px4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917386, "uuid": "83b4445a-bc1b-4602-9442-69d248a0d248", "value": 138014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917386, "uuid": "4eb646ab-a687-4716-8f03-d4557f0e6395", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917386, "uuid": "c3c0c32c-acff-4143-9924-04fc9af62e89", "value": "invoice-1645080830.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f23cb80-1161-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771924452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924452, "uuid": "eed867db-252b-4370-939b-b45bb0d957bf", "comment": "Malware payload (SnakeKeylogger)", "value": "58d5831f8c8fd4c44ac83626badaab0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924452, "uuid": "cbe29a09-a1e0-4b12-a11d-c141fdc5e36e", "comment": "Malware payload (SnakeKeylogger)", "value": "f32cb2ac264a1c0fbd63adaad340ba4fdb6b48af50ad2ec346e4142c66ef5ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924452, "uuid": "b30a6b55-9149-4083-83f1-905f37df1bff", "comment": "Malware payload (SnakeKeylogger)", "value": "d1eb3d443fec2842f2b0970c463ee36c81377a67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771924452, "uuid": "035d8d4a-1d46-464b-9f01-3754ff47146f", "comment": "Malware payload (SnakeKeylogger)", "value": "cc41ebdfa5a150d22a2a9126f744707473d6b9ffc9f2ce13e9220f8813ed9baa77f1435c273fdd33dc7cc8ce3f5f3cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924452, "uuid": "283c88ca-b138-4a78-a81f-62087db62bf9", "value": "T1C7C41291A6C59A60C210A330C436CC6086793D30AF11BA6E8729E95FAC753D7DFE7B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924452, "uuid": "019ac7f5-35ec-4295-850c-b335a9b22e5d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924452, "uuid": "c6a249bc-3138-44af-9aad-34abe9df3029", "value": "12288:Uz7hU5I5yuNHIgzSFKxWltRohBfSTso93UulESXSD32:Uf+iN57Gtene36RL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771924452, "uuid": "f8c36b70-913a-45a0-8190-154979e77135", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771924452, "uuid": "09ab6ab7-b83b-40b2-b256-35e4209d26f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771924452, "uuid": "e8e94146-2f52-4805-88c4-c0809f54960b", "value": "new inquiries $1,710.000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee7398c-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919351, "uuid": "f2748780-1eba-4384-b5bf-6baa659c451a", "comment": "Malware payload", "value": "401614c02ce15847080ae3d5c451d06d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919351, "uuid": "7598318f-f6ca-44cd-a1e9-67f34fa233be", "comment": "Malware payload", "value": "f3da93d336f46a4d8e2348172c9d6e99a8b735b06deb6f42e3285504c1a72222", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919351, "uuid": "6268a8eb-d197-4465-84a1-3a633c0e6ebe", "comment": "Malware payload", "value": "6ae0c4dffdcd0b0161cecbbfea07953cc8b14a6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919351, "uuid": "17b60eee-fe95-4e38-bb3e-dd6d2536e808", "comment": "Malware payload", "value": "0fe60690fd5e62153b25cdcbf4be2701e189a60b41c21df08df94ddc8062e73384a12b1403073961fc460e6c6567142e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919351, "uuid": "62285b1b-2909-40a4-8d83-440c0ab59a29", "value": "T120D30AD36571A7A8DDA2573134C05BA8DBF2B1B69FA166E041510F3AFD249F3B60E0C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919351, "uuid": "66d34970-31f7-4d6b-9c9f-85bfea76a521", "value": "1536:CPXZ6uSEYzG9t/aq24xeX2F8VRHq8M6limlhbTktR9BPHDWxPbpjFrxzCH/DltTe:CPXZ7Y/pj+4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919351, "uuid": "67f8154a-0a99-456d-8cc6-b82984448f4a", "value": 139944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919351, "uuid": "e128193e-907a-4a44-807f-73658c6128cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919351, "uuid": "034f9f98-a408-4d3c-b1a4-5cc86f343ebb", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea6bd7-1180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771937788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937788, "uuid": "e3f2918e-b1aa-44a2-aa6e-b1cd571f230f", "comment": "Malware payload", "value": "8725dd4ac50b7ea91096c3877098e59d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937788, "uuid": "6cfa5208-1ccc-45dd-9ba8-706f293b9770", "comment": "Malware payload", "value": "f3fbb7cd3f74be82f7f41dd36c20957ea5ef2de4c918c9a6e0be651e44557a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937788, "uuid": "5d8ccb3f-facb-407e-ac80-af43ee23c92f", "comment": "Malware payload", "value": "8bed500c8342d576f393bc35a669a4abe9e3b4a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937788, "uuid": "44c77af9-338c-4fb8-adb7-e4ef548d477e", "comment": "Malware payload", "value": "5e2af0e90319a331134ca794d70cc7a385639066debad94e605789d23a7f9e4887019ccca54497548cb60cdbe1173dd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937788, "uuid": "0d08b1c4-58a5-4603-a1d6-8908ad56c9b0", "value": "T100969D03ECA555E9C1E992358AB29152BB717C490B7123D32FA0F7386F73BD46AB9340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937788, "uuid": "4316d73a-43fc-479b-bed3-3bfbf4834cf3", "value": "98304:8n9Rr56lGbZAb4QDpEbxaHETkvEmTpWsiZ+P9OiN00N3eJh88:8nJZAvDpAn1mTcsd1peP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937788, "uuid": "ab268f48-497c-4369-856e-a20976a7de15", "value": 9116863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937788, "uuid": "f3ae6ef8-8e69-43ad-ba77-ced00bda610b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937788, "uuid": "41004750-08b4-4002-aea3-91af68129f0d", "value": "mine-agent-linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17eb811-1185-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771940186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940186, "uuid": "7175eb8f-0bf9-49c7-89e1-a4f69f45eadb", "comment": "Malware payload (SalatStealer)", "value": "6ba7ce6253edfc0fd4e2c651845bcb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940186, "uuid": "a159e233-e373-43af-9428-8ce69aef9037", "comment": "Malware payload (SalatStealer)", "value": "f408f9bbedfc85118d1c20e8f80a00230afb6ac48accbf81f91a05bc31a54f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940186, "uuid": "d79bef96-2b0e-43fc-a0e1-eec6ca2f4caf", "comment": "Malware payload (SalatStealer)", "value": "446ed988d87dd14856f66ef27341a780aa5420e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771940186, "uuid": "a7b31e4f-5abb-4506-bc0f-b0934e3ceb76", "comment": "Malware payload (SalatStealer)", "value": "f82f8e53b6744f5699ae145a7e0f254489ebf10f9f94de65a1b7504e0c54172f113ae7dae9c88b4cf38c6da1871bceda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940186, "uuid": "9013ae7b-9866-4a58-9961-8d3012f35262", "value": "T1E0C65A11FA8B98F5E9031831406BB23F63355D049B28DBA7FB547F6AFC7B6811936209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940186, "uuid": "4fee696e-210c-4d6a-b27d-72a4ef84e025", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940186, "uuid": "30c75532-35ac-4dcc-bc7a-3698a70839af", "value": "49152:BT7+pGfoqUEhSn15lV030hh1avPd9HmdbIwTtuG0WuCN9ag8e8hpuEc25VytCqpv:16pGf/SSaKG9xagsHf5IeD+2HDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771940186, "uuid": "d9bca48e-02f0-4048-b22c-824021a82cf8", "value": 11672064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771940186, "uuid": "b95f7d1a-1310-43b4-9a70-65a389c585bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771940186, "uuid": "be686de7-2d3d-406e-b097-39b2f38b3015", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6640ddb5-114a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771914666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914666, "uuid": "0cc5710f-00c6-4a31-aba9-1f5f8d454ed7", "comment": "Malware payload (ConnectWise)", "value": "790e14059161599a55fd9eb4090ff6df", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914666, "uuid": "1e7e2401-a6cc-4b1b-b5e7-fbbd76e73f69", "comment": "Malware payload (ConnectWise)", "value": "f43915adaef642f7cfce31db31925d14b639d12e5e1864a85160078a10c22d62", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914666, "uuid": "bd17c902-f49f-4c2f-a926-64c1eec9e9b0", "comment": "Malware payload (ConnectWise)", "value": "1fbc3488911d890b487e8743914b9b1d03a27d11", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771914666, "uuid": "27790ff0-472f-41fe-8d13-2a0e76545a4c", "comment": "Malware payload (ConnectWise)", "value": "e3094fbebfd87c3d1cbd194e94765653bf10fb4f1b52d9ea8e8eae47307c14a83b5ff094a2c40110c3231ab958f72b53", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914666, "uuid": "f1b7d1eb-f2bc-465e-bcd2-216f7c8baa61", "value": "T100646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914666, "uuid": "45e5dbd3-a689-400b-a93f-a6663fc09441", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914666, "uuid": "ebb4effd-ae65-4235-8efb-c4e81b3e7b38", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:Q1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771914666, "uuid": "cd1999b2-c41d-4052-bdaa-4e13effa8a2e", "value": 312592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771914666, "uuid": "0c34aa4b-788c-4530-bf7f-26e965aeed80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771914666, "uuid": "e1fe8a11-32c1-4a01-af0c-cf7cc5804b0c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b345a28-1151-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917547, "uuid": "f6debffe-b225-4690-87b2-34c7b86879ed", "comment": "Malware payload", "value": "7f58f7c320697c60624ca121f10d332d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917547, "uuid": "2d706de4-476f-4568-bf1c-89c9fae746df", "comment": "Malware payload", "value": "f4594408e8aeef62434443d6e0c91a342d8862aaf80a36cfd0ac0410b2d2b222", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917547, "uuid": "6be59c3d-ec3c-4b84-987e-82e08838597d", "comment": "Malware payload", "value": "e38e2d44eca81e107aee588b0bc221e7f3eb81e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917547, "uuid": "539cb3cf-8f74-4ae7-911d-e7cd9a5e8a1f", "comment": "Malware payload", "value": "5fb941fb3974b9f6436ce335c6fa5dba55fec32cbf2d78750166b33b5566abaf39d4ab40094aeae8cbc58f1c9c1ad8e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917547, "uuid": "397a8483-0998-44ee-8af2-c5b01aa3cfda", "value": "T19AD3C8097B92EE20487F10B5B2EBA3D86A3B3353D5D6F48E3A12BC148FD94A81F71155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917547, "uuid": "37793cfa-e870-44d0-8368-46a70ca53294", "value": "768:C8m/Z6sZjWsYuSwnckNuRaXFkpuxcu1g1xeLScFYHXwz04mYF6F2r:CPXZ6uSEYaXFkpH4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917547, "uuid": "8362a78a-f58d-40d1-a5a9-a7f191c6f942", "value": 138973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917547, "uuid": "ec667751-c08b-49e4-9388-515d37c502b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917547, "uuid": "936ad210-4c5b-4d65-8c86-1b1d0555cf00", "value": "invoice-1645080830.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c32d482-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919266, "uuid": "2e4b5545-e4e0-43a0-b03e-07aede3a96aa", "comment": "Malware payload", "value": "86d346379280b246163a1ec1ff6d9f55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919266, "uuid": "6928d6fa-da7c-42d5-bad7-0b34c9137f0e", "comment": "Malware payload", "value": "f46ad0c746f0e3f276de73eb2e531fd920ca8bc398b557ddf5eb1dcbd49f37a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919266, "uuid": "6555f56a-2617-4eb3-a5be-4d15aad6912d", "comment": "Malware payload", "value": "1c2f28a01911addac7657f94b8937009b7e19ad7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919266, "uuid": "b3f7e6bc-0181-4c3f-86f8-87dc8bac0623", "comment": "Malware payload", "value": "6254f1874d5af897b2c0bdaef1f3b0c1784ad968799af89deb7ceeeb79ad311a9d76a42a355a5f796c1359f95492fe91", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919266, "uuid": "c63e0fe2-d5ec-42ca-b57d-f22d3da3b297", "value": "T109D34C1031868D059BBE1CB1CB9F39A4DA9CEE79D7C401298FC77EE289B549962F07C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919266, "uuid": "9df7e7df-7468-4974-b459-137efc97afb4", "value": "768:C8m/Z6sZjWsYuSwnckNuRWLvOi8Z4BFZpBMXxeLScFYHXwz04mYF6F2r:CPXZ6uSEYuNFZpm4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919266, "uuid": "e87a34ac-ae16-41bc-89f4-0b73f1f822bc", "value": 138913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919266, "uuid": "1b4401a8-7aed-4941-af1b-80e541faae8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919266, "uuid": "6a6be2f6-b86a-4fdb-b6e1-9d3fdb1041a7", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92319392-112a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771900996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900996, "uuid": "5463c230-d5bb-4a2a-a247-339f8e434f4e", "comment": "Malware payload (SnakeKeylogger)", "value": "3f597263fe9528370f052d572670f730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900996, "uuid": "93a23c5b-00e6-48d4-b90b-db7f1fa88c8f", "comment": "Malware payload (SnakeKeylogger)", "value": "f5579aef87c24c6ff57e30c5d12ea0666343fcdd0f1f0af4c849c9caf53cb69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900996, "uuid": "43029656-ecad-4f15-b044-fd3eedf8991c", "comment": "Malware payload (SnakeKeylogger)", "value": "6635db47f3a10dda9a0b39ab75445e37e2788126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900996, "uuid": "3a586292-0898-4095-a196-30c61bd79940", "comment": "Malware payload (SnakeKeylogger)", "value": "976993fd3c6f0895d85535f3dca347268c2bcf8a480b7072b551ded9f716b1e005c5aaeb523b7e0715d4a44613b02bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900996, "uuid": "0a005b87-1a1e-44af-ada9-6406bda6ae23", "value": "T1D1C42295DAC16991C6403330C832CD458A7878B19D05773E876AF9BE7CB0383DD66B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900996, "uuid": "4bc69fa8-ed2e-45be-94ad-970a9f22f58d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900996, "uuid": "be8b4d24-826c-41e6-9ffd-b43638d9813e", "value": "12288:5z7hU5I5yuNHIgzSFKxWltRohBfSTso93UE/RuY+bC6VAJ7:5f+iN57Gtene3NRuj12J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900996, "uuid": "ae1cfb74-9d2e-46c5-9480-dded3b6568f0", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900996, "uuid": "2aa2d819-564b-4abc-9782-c97f65e02a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900996, "uuid": "65afe2ab-62da-417b-b5eb-3698d18e4b88", "value": "new inquiries $1,710.000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890469fd-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919449, "uuid": "e6b5b719-aa5e-4430-b53f-181a628ce485", "comment": "Malware payload", "value": "58c5ca287cc8cbfb19096a0a249b96da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919449, "uuid": "f71f5c1e-7d6c-4e50-b0ae-64b3508471af", "comment": "Malware payload", "value": "f55986c935d326ca5fefe6894ea49b70b596bf40d5be6d2cfa846882f1803e7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919449, "uuid": "8c480ef3-d264-4c14-9ab3-85cea292daa8", "comment": "Malware payload", "value": "ebb84c48d056e7884f022c1dbc1fbc544b528137", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919449, "uuid": "0767cdb9-ca1e-419a-ba6c-b492ce35dad3", "comment": "Malware payload", "value": "afc879c8a5b086c115972e0f9e2bdec829d3740720d9cf654fa2427fc13a8a922396a21081a2e2ea9f23f1040b0a9b8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919449, "uuid": "5c8414df-b6a8-4bf2-b4c6-c0a01d984299", "value": "T163D3EACBA432B91C39EF54638F980D071C0ED25D59A3943B11C4ADC8F66E7A65E06CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919449, "uuid": "8927d672-0383-4759-b58c-52b32467a364", "value": "768:C8m/Z6sZjWsYuSwnckNuRzCpfuPK8jmI3TFODoxeLScFYHXwz04mYF6F2r:CPXZ6uSEY2pf8pFOE4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919449, "uuid": "73096c50-98fa-499e-b656-0858ee1eea12", "value": 140893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919449, "uuid": "bdcd68b8-d5f4-4c3d-b572-012e1c388cec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919449, "uuid": "c37cc8fc-b324-4c95-ace5-b8d4aebd6917", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f351863-111e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771895810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895810, "uuid": "95002583-0fba-41bc-97f7-beaec0950a90", "comment": "Malware payload (Mirai)", "value": "673c2e437f70aa53ed3718b7973e6ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895810, "uuid": "46cfcda5-6f5c-4fe9-af6d-a06843dd78ce", "comment": "Malware payload (Mirai)", "value": "f6821e8dd7646432c45181efeca34f118a7a3fcfb4a258f43ba6bb227731248d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895810, "uuid": "4b42e374-41dc-4702-b7be-eb0efb120187", "comment": "Malware payload (Mirai)", "value": "75069b447f5c3e35417b0991ed6fb36969458610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895810, "uuid": "293a8f80-953d-4b42-9af9-75804d9e1674", "comment": "Malware payload (Mirai)", "value": "b5b5e6daff1d37578674de329d4e9b1781dd597a1411b55079e48a296446ce3dcf3ab2eed7f5010a705e26e67d70e245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895810, "uuid": "11f2ccb8-f2c0-4f8b-b17b-6f7f552db113", "value": "T1E7736D52B70C0A47E4531EF02A3F53E2C3AA66E120E8F684750EDF49D6B5E325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895810, "uuid": "295c0a03-d93b-46e4-b532-75695118390d", "value": "1536:R0TlIx8MunD7YKa/Wymt8z3PsoLWMypIL7jwDbur09MdAypwEQ:cKNKaFmt8rkEL7AurIM9Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771895810, "uuid": "1b573773-89ab-4b47-be8f-d2b8b73906cf", "value": 79608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771895810, "uuid": "b8c8a1f7-ef90-4b52-8ef7-addd4e1a9c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895810, "uuid": "0f3e8d57-05b2-4b52-a8aa-0307e0a3bca3", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3549b023-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950232, "uuid": "dd5eeab3-3f83-49e6-9676-439fe93a552c", "comment": "Malware payload (Mirai)", "value": "e7b2805f6541ef8b5f5657936835e963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950232, "uuid": "c2adf94d-5873-4a08-8e15-71f43337646b", "comment": "Malware payload (Mirai)", "value": "f69861f86e4ae1c87d1c61ecc056963cb1ca3817be5ac16b3abfbb7da54039e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950232, "uuid": "cb588df6-a73a-4049-8c31-06b49c33aeaf", "comment": "Malware payload (Mirai)", "value": "48e2373289b9c54f66612a113cb99a143fdbe80b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950232, "uuid": "a3ead10e-214c-4518-b11d-e83d26ff2d17", "comment": "Malware payload (Mirai)", "value": "b07254cafcbf92b4f02978cbfdb06243a33c480f978d0b8d3d511becdfb5c537433052d88617969b04edf63c30c52349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950232, "uuid": "ef8289b7-1a2e-4ea7-944d-0a44f38eeed8", "value": "T1C6C31859FD819B11D5C526BEFE4F528A33135B6CE3EE7212DD146B2027CAA5B0F7A002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950232, "uuid": "72169ec5-006a-4bb4-9944-6157b1fc2143", "value": "3072:dtCUZcJfYUynJkSR+M+A1T9lABxGWa+Aa/wiabxqLs6plEtfPFdj:dtCxfXynJkSIM+S9C+Wa+Aa/wialqLsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950232, "uuid": "3fc2965a-a727-474b-b543-3f832f4b8bdc", "value": 121972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950232, "uuid": "a1261413-bb96-415d-8935-3a5e387141a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950232, "uuid": "19951c7d-2b6c-4c03-8bdd-9017c87ba71d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a2bca6-112a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771900945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900945, "uuid": "95e9c1c1-a647-4a2a-98ec-4caf05af65e0", "comment": "Malware payload (Mirai)", "value": "f0f21de25515831910c30e83564d08c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900945, "uuid": "b9f088a6-1f07-49a6-b12a-7c1745df9412", "comment": "Malware payload (Mirai)", "value": "f83d32398be2836d987a1b3e33b851fdfbf59cb6d97d86bbde1d6f667c9cdedb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900945, "uuid": "9fdcea95-150a-4027-a56d-4f6c10e5d58d", "comment": "Malware payload (Mirai)", "value": "8f3c4928dd524cc40cce94a6e827fdfde7f7126e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771900945, "uuid": "4247a768-bc1e-45c3-9088-1273f5d761c6", "comment": "Malware payload (Mirai)", "value": "6d2d9824950a029fc4b0f733f2a562bf4ce24b3fd4736c5bb050faa24018f93fac09f0b2310ade7fe4acf6422731ce81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900945, "uuid": "f21c96ef-81ae-491d-901e-4dccf28f6a84", "value": "T1A9832907B58180FCC48AC174179FBA3AD832B1BA1338B26B77D0EB223D59E611F5DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900945, "uuid": "55f6ccb7-968f-4ce0-923c-96090d52933f", "value": "1536:xMNA1mwrkLNWj331IePPK3fdARJH3p0KWxu+10gN+4h2D3XbnC/xrbhu:NmxLNWzFZK3fdATZ0K3+10gNG3XDC/JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771900945, "uuid": "f6013fb9-4ab6-4749-9513-b2fe74c0834c", "value": 88448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771900945, "uuid": "9948dab5-1b5f-4336-afb4-8679eb07f012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771900945, "uuid": "6fd67281-b9ae-42b3-a4ab-f60831a40170", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff48f5b-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1771921903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921903, "uuid": "91a270ad-4609-439d-a3cc-3cecc987669c", "comment": "Malware payload (ScarfaceStealer)", "value": "a5bc0798441e90e3aae631ba4bddcc00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921903, "uuid": "494af39d-3285-4d4f-97a0-a60518370322", "comment": "Malware payload (ScarfaceStealer)", "value": "f9801affda80569032dabe323e7c8bc25a6e9fef23b796d248ca648e77dd28fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921903, "uuid": "dcb7df93-f75c-4721-8daa-de225b747751", "comment": "Malware payload (ScarfaceStealer)", "value": "518750ce84e930cd5b5334c034a7da946d8c8073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771921903, "uuid": "08b2abb6-1a2f-4dc2-aaf0-373e0882f769", "comment": "Malware payload (ScarfaceStealer)", "value": "9845f163c4e37051ca7bf289b2988773d8e549fb5d1650ce30a412982cded2a954b43e4ddecd64bd3587184713077c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921903, "uuid": "82ed7fd8-23bc-4f49-96d4-7b71379e4c9e", "value": "T1CAC623E886D552B580E24200B18BC39A7581655E85FD5C193EDB2C82372ECBF518EFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921903, "uuid": "1326381a-4d58-411f-a2c5-88e0779e31c8", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921903, "uuid": "95a8981f-5372-453e-9b82-229c6494dd33", "value": "196608:6g9LVMpQjqnm1K8jN1KS4dzCarjPHvrwRRuGX+4XorS7El1PiWPyW3QDl:6g9LVt+mt4dzCswREfWEuQyW3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771921903, "uuid": "40790028-3863-449e-b90f-c68e5bfa9410", "value": 12528128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771921903, "uuid": "c6278817-11f0-409d-a7a7-8883f8b71c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771921903, "uuid": "a1f13759-4906-4744-9a10-c9fd83f856c6", "value": "Payload (20)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc04a57-117f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771937660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937660, "uuid": "fdf82e8f-5d06-4c79-a16d-ee08cad147ea", "comment": "Malware payload (Mirai)", "value": "edd3bec76885759dd680dadb45faabd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937660, "uuid": "4d70e225-4837-46f8-9bcb-29adf60bc81d", "comment": "Malware payload (Mirai)", "value": "f9f67d4e9cb5366480631d75db0122680595a6d471e51eaebf8f4ac2b1ad5e1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937660, "uuid": "eb92c484-4a5a-4c70-ba17-8e6459774443", "comment": "Malware payload (Mirai)", "value": "0259e83c9bbbe8e9fd065914ca92b21d6e4c1c3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771937660, "uuid": "8b347b58-f914-4716-9410-f477a9f25ec7", "comment": "Malware payload (Mirai)", "value": "c2b82c195089a9313affe72fde2ed47fe4e63588a2c5f13bc9032015c43b033d65815cff5968f78f81e5f9719013c897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937660, "uuid": "3587ce93-eda5-43e9-8b37-99927b5465ba", "value": "T1C2155B42BB184563C9530DF0593F43D9F7657A4341F8A32B270E9B672621E3ADAD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937660, "uuid": "bfda9117-001d-4565-8d39-866ceb3f632e", "value": "24576:5AVrJ1gw8yJ6BlSIBwrxigM9oC+SrKQ8shVc2:5AVrJ1gOJOlSI/gM+sKQ8sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771937660, "uuid": "f2e9b7f2-0a63-44cb-9d90-b4e443643bf3", "value": 932112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771937660, "uuid": "4e770b47-8ed4-4a8f-b7b0-04d7c613208e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771937660, "uuid": "4bc03c9a-8709-4066-a38b-fb6f45475dcf", "value": "a2work_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f317005-11a2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1771952530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952530, "uuid": "02d76d98-a959-4c29-ba6a-426b3f4b2f25", "comment": "Malware payload (njrat)", "value": "a309115b10cc15a38f3b3a7f585d9590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952530, "uuid": "96bf9d69-c237-4862-9337-74efcb3c897d", "comment": "Malware payload (njrat)", "value": "fb4b742b339a1a532a7a72929a675b3cd439c1098d35f5a844e5ec580350d17f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952530, "uuid": "4b38332d-943d-42bd-be34-2a0e4491c922", "comment": "Malware payload (njrat)", "value": "1b223b94103b1c3433982e08c618173fb98e5f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771952530, "uuid": "412ed034-6ab4-400b-be15-53b4811efa12", "comment": "Malware payload (njrat)", "value": "279a8b54470e4858d341c113bd350836f730cecc6e6ceb8c19edaed0f3a14757ac0e2641c2954811c136530df9e9e13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952530, "uuid": "ff663b61-9974-4863-84a6-2d55011d4d27", "value": "T133032A4D7FE18568C5FD097B06B2D41207BAE04F6D23D91E8EE164AA37636C08B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952530, "uuid": "a7b5f92f-e7c7-4adf-9355-e2446340311f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952530, "uuid": "0d7a4f11-b435-4bea-9323-4906b9ebc4a5", "value": "384:uj9Z3j6icBri5Z7JAyk/KN46fVlZeiusYrAF+rMRTyN/0L+EcoinblneHQM3epzv:q9LHJ7k/C46TZbudrM+rMRa8NuQSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771952530, "uuid": "b72e2b49-930d-45e4-ba01-bc02ce2291fc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771952530, "uuid": "10163c89-bf09-4a3e-8534-d1968e60ee60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771952530, "uuid": "6e8c45e8-1e78-4bac-b858-6eaa1fa97338", "value": "yupifeetpics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a75902-111d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771895579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895579, "uuid": "34d3c84e-5780-4fbe-b489-d9d1f461c5dd", "comment": "Malware payload (Mirai)", "value": "0bf034b0137beafe42fbb01b54558c9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895579, "uuid": "3cba33a2-2717-41d9-9d67-43b24ef62cae", "comment": "Malware payload (Mirai)", "value": "fb5ca26f94c2913ea19108415cd528630d14f501d1bf46155a3b303cdc7a0cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895579, "uuid": "6ee2236d-682c-492a-b896-2a748a5011ef", "comment": "Malware payload (Mirai)", "value": "ebe7a9709009c72654a6fad8801a690599f6ad30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771895579, "uuid": "710b6bab-5d03-4e1d-a384-f0058f8d7073", "comment": "Malware payload (Mirai)", "value": "f7702d3ff4064ecb329aeab7a1c3c59d81fc9181a9a7385f20f118c8fdb4085554dbd0e99721034fb50242afb1a39f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895579, "uuid": "d7dd8b5b-6c85-424d-8f62-4240cf94ad4f", "value": "T14D934A22BA750E27C4C0A4B621F74725F6F24BDA26A8891B7D720D8DBF216403557FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895579, "uuid": "9a8028bd-dff9-4215-aa1d-35abc46d8b33", "value": "1536:WYScMKVrZEAVWvYvrijndbHVSuuOvZ9BdHAtVd6N+S5ardZ1QxuTtOF9N:W9pKVVpWlrZxLzAX8NVarJ8nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771895579, "uuid": "a1fcf5c6-5dda-4222-be4e-db63cf2f4015", "value": 97552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771895579, "uuid": "62e0177b-a158-48ec-9640-12210b7f37b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771895579, "uuid": "cb3a9684-2a88-47fe-aebd-88f66381a783", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f60feb9-115b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1771922010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922010, "uuid": "3212e6de-c929-4519-b13b-5dd0c0fc7d60", "comment": "Malware payload (AgentTesla)", "value": "48e87bc2ca8c4ac19e65b88bc2ca3284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922010, "uuid": "f51c59aa-2e56-4d5e-b206-8ce30d2d8432", "comment": "Malware payload (AgentTesla)", "value": "fbdf3cd3e9d1c001ef9d7a295e27b31b1a48000907bc2565fdacfa2d4091c820", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922010, "uuid": "96b2677f-e69e-4b7a-a9a1-417179fdd162", "comment": "Malware payload (AgentTesla)", "value": "a3d776be8e4a3401ed67a01421e3d84fff21eb57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771922010, "uuid": "b230dae9-314c-4157-9892-151c4dec6c68", "comment": "Malware payload (AgentTesla)", "value": "b7cdc23df33971bf9342874185035ce6910ba4efe26bb84bd1d672aa4a1e06601c7476ff038a654e8e64c57addc57af8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922010, "uuid": "f99f9829-236a-42db-9f8f-2c7c09364056", "value": "T10B2512746725EA12D4E66B750A71F2B95BB92EDEB810D3074FD86CEBB872B018C04353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922010, "uuid": "ce386535-6c18-4f64-91ef-091308cdd076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922010, "uuid": "0015caf6-e14e-47c7-9264-08edff815a5d", "value": "24576:4HklYjmX805iSfQKlCkZfIaDrK5J1AXcgotcs+:4EmjmXn5iWl3Aam6XcgotB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771922010, "uuid": "cb3aff3d-6512-4d3b-97a3-4aa6a3258d56", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771922010, "uuid": "a56a3379-e243-4fc5-a36d-2f83a307e24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771922010, "uuid": "f47d665c-dc49-4743-a2f4-a4a04f5e1102", "value": "el1PHilkbKikPId.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9defdb37-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919484, "uuid": "eeaa8bba-471c-434b-8a17-eae24f26b8cb", "comment": "Malware payload", "value": "cff5bd9137560e4544d992479504f90a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919484, "uuid": "f87bcfe7-cd92-400b-aade-e7586bf988df", "comment": "Malware payload", "value": "fc63f75a6d659d343a4d5e613058a445739a14f0bbed67dead3e45349d8e2ac6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919484, "uuid": "90cf1552-4511-4634-b3d4-1f0b46365a20", "comment": "Malware payload", "value": "112d5d4e9a7bbb0f547b385498373b1967f0b73f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919484, "uuid": "0b678499-3124-4ab9-91a0-85bb3e8957cc", "comment": "Malware payload", "value": "69173aec6aa2e588f653b2b35b49cf6b9d1fad55ae4f58b66981309467345a47a42a0d8c5c8534e2aa777931b41e84d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919484, "uuid": "6e98a05a-b84f-4ecc-b840-7991d53c11c4", "value": "T15BD3D75193AC27AF5C1FA700C4575D9990058F044E2FDB7EDD1EA50A0F0AB6F1FA8EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919484, "uuid": "f3eb9417-c5c4-4faf-8218-5a60ba7e96dc", "value": "1536:CPXZ6uSEYwDWBYWXUjJwwoCbKOxdpYYp9AkPJKV1CLLRmCgpFEQqVYtZ4HYYdum5:CPXZ7YDpoc4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919484, "uuid": "04cf3e44-c63d-4c0b-ad8f-873832d7b5ea", "value": 137032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919484, "uuid": "e74dbd39-583d-4c95-a16c-c84558b4ea5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919484, "uuid": "0fada294-d573-4c79-860e-2fffe880018a", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365de0b3-1166-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1771926612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926612, "uuid": "149afcf0-7e53-4f14-9c63-0445aa512e64", "comment": "Malware payload (SpyNote)", "value": "94fc04b52aa91ad133be46ab8c2bd878", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926612, "uuid": "fcee1da9-9e18-41c9-b315-048222af7b17", "comment": "Malware payload (SpyNote)", "value": "fca04c73ad8c4626e4026faaac63fbe6c2a6404952e1c53d657b696480789553", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926612, "uuid": "5eb548f4-c337-4ddc-be2d-fcf91d163427", "comment": "Malware payload (SpyNote)", "value": "d0365b494caea8f59819356468ac4936d7780c0b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771926612, "uuid": "ac91e9f2-f61d-4e77-95c8-601f7b6e66c2", "comment": "Malware payload (SpyNote)", "value": "f77d37c200b9335230a70c7b7947104c1c738bfcf03f61db8b16a465344ac99502158c96cf24ba3195032602a7ebf78f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926612, "uuid": "25f3c9ed-f9bc-4262-aaa3-f2779c5ae5db", "value": "T16305AE96F71AA866C9F7CB3643B9476A1646CC14474BE7930981B23C1DBF9C04B89FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926612, "uuid": "fdd3ed75-9edf-4543-b577-6f6fe024b154", "value": "12288:4yDMUTYCnBh8wzHDrtq48O1m1JdiLaD26C9XgqRCIlNE8Z6GvhZ3:4y4UMCnB5zHtq4LmrdqaDnG5Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771926612, "uuid": "77597c9f-ee5c-4e38-b1ca-7b73b249a93b", "value": 859958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771926612, "uuid": "b4edbcd7-bf24-4883-836f-e871e39c4f61", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771926612, "uuid": "8deda619-d7d1-4368-a96e-9c9fa16aa353", "value": "client.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17d9b7b-1150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771917423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917423, "uuid": "7a2d2b37-b377-468b-a614-5ef24b998b2d", "comment": "Malware payload", "value": "2188ea8e16a6a09b89189b2f91ca268c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917423, "uuid": "708fb722-199f-49b0-872b-2aa39db8a0fc", "comment": "Malware payload", "value": "fcaf6fc36b634411031cda1981309a84bde83de74c82ad15de4ec70f196e5b5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917423, "uuid": "0f07bdb5-d801-4961-bc15-8ec2aed1adf7", "comment": "Malware payload", "value": "0b0b40dc0f1d979b58b517bca32e9cba7be12100", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771917423, "uuid": "246b6afe-63a1-4663-a3eb-ed5c183f139e", "comment": "Malware payload", "value": "c6d5f19eb5823b30139e69317c1583ac1a6bf2b7ec698a29af41c6295d5c04283453dc6192aecdfb2b0730583df50992", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917423, "uuid": "9cd56330-ba3f-40ab-938e-d0680f4cccd6", "value": "T1F4D3FA611A6FF8289DF575F45DD3284FB1E30A1AB0AD3AD620348564CBFCF6254BA0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917423, "uuid": "2a5bed2d-1e66-496a-b907-617b159ba027", "value": "768:C8m/Z6sZjWsYuSwnckNuRcFuMIqhubA09zEi1N/HLWPvkRvjXOAFupji52pEpIsd:CPXZ6uSEY9FupjiY4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771917423, "uuid": "674cc97a-8fdd-4ef5-a073-aeaf19b8ed5c", "value": 140891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771917423, "uuid": "4d460edf-8640-419b-80b0-d1af42dc059c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771917423, "uuid": "8a73ef5a-7073-4a18-b48d-90431e497e8f", "value": "invoice-1645080830.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108a4dc1-1122-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771897342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897342, "uuid": "3a837cd3-da76-4fa8-af98-529ec3f21f5a", "comment": "Malware payload (Mirai)", "value": "ff9b80af019d08811ed95e0a0cabd6b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897342, "uuid": "9cfcdd04-fef3-4328-a7d1-a5ae999cee2d", "comment": "Malware payload (Mirai)", "value": "fcefe0fc3a017c59af6ab3737c48196f641296c1d1f0673593d6147bead541ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897342, "uuid": "df89d4d9-1f3e-4bcb-9fa5-6fba9b441cfd", "comment": "Malware payload (Mirai)", "value": "c8ba2616d30f4176d215879c43d4be3b2649967b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771897342, "uuid": "191dff55-e2f6-4688-a89b-8532ccaa8841", "comment": "Malware payload (Mirai)", "value": "0834948d9daf4f5fa603e8721c6f1eab45efb6fc8c06543458cad4b38a3f4789b08f5f26a028ecf2462fecead89a7185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897342, "uuid": "a8bb9caa-8062-4e34-bb18-bf78587cd595", "value": "T163333B96F8925A6AC6D046BA772EA68B335763B5C2CF7353C84C0B11768AB0F0D73D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897342, "uuid": "3e5d61f5-3da4-49fb-b566-74e36b83f9b5", "value": "768:o19Q7e/K9+cp2pLQo/C0JXxt7qihVrn7A4blnML2F+n95zz:iAe/K9ap8gJhtWiXrn7N0T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771897342, "uuid": "26019c51-39f3-4326-bc97-717c6e7f1c98", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771897342, "uuid": "2fdc6382-fda4-4ca0-ab30-8dcab59e89c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771897342, "uuid": "db5eec8a-580f-44d5-9ff9-7ae5d4e110d0", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdf2992-1155-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771919460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919460, "uuid": "730495aa-a965-4e02-8d41-b3ba8eaf59cd", "comment": "Malware payload", "value": "55c6e7031ebc9bf341462be969e7f2ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919460, "uuid": "30ba1ea5-d6dc-432e-b426-e1dbcc8098b7", "comment": "Malware payload", "value": "fdfb9fbd83b14ed0b7a4ce7d415c3854fba7ed990392650abbcce07ac7453729", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919460, "uuid": "2b96104b-ba1e-40cc-8253-e93aa1aa42bb", "comment": "Malware payload", "value": "37c7d1191aaa121149c11ef2d9fd1e059911fb97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771919460, "uuid": "1909249d-399a-41da-8728-b6ffc86a1b67", "comment": "Malware payload", "value": "9e3a6e934e2474ea127b1afa6289479d9d6d9e3f3886b2b1e05ea43e358cb94933e67f733b1a71af7cfe964b3be354c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919460, "uuid": "fdd17838-3046-455a-b992-95ff1c30bb0c", "value": "T1E1D3C745BD025CD60B1FA398185C3A3ECD808A3BE9E9A74A7C178EDA0F4C5570977F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919460, "uuid": "79a4bb35-6451-416d-9232-3abd492d4a69", "value": "768:C8m/Z6sZjWsYuSwnckNuR8q6TFR6pFHTvxeLScFYHXwz04mYF6F2r:CPXZ6uSEYQTFEpF4YHXDYFoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771919460, "uuid": "9ae16da7-a174-4639-ba7f-11304d3cfeab", "value": 138930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771919460, "uuid": "403ed5fb-5204-40a0-a615-a1dcd6774e55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771919460, "uuid": "d579ce32-3f38-4962-931a-73752f6251f6", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dd9c1b-116c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1771929136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929136, "uuid": "67079d32-c25a-40ce-8e19-60e6dbdd2503", "comment": "Malware payload (XWorm)", "value": "86af942ed79b527d3b0a98912d899713", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929136, "uuid": "93050a30-ea5a-4382-b990-46633e924aa1", "comment": "Malware payload (XWorm)", "value": "fe3ce7381b6e6604266a8e5254262c7abbb9935ba8c80c1c8e25d9ef01ac021a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929136, "uuid": "d73d7643-e632-4ca6-a50f-100be8a4ed27", "comment": "Malware payload (XWorm)", "value": "8ae5d35d128218c0b759793f6eac6783a30dc26e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771929136, "uuid": "2df0c4f4-c353-4b2c-94b8-a9ec5c073d77", "comment": "Malware payload (XWorm)", "value": "fc064a013fe1a13cd26d1950fcf8252ed8837f4c32850112961a1643e9602227b19e895e0b06d9b4e9f561650b9b80ba", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929136, "uuid": "164fd807-31ce-4975-905b-8cfcb650e9ea", "value": "T1DE835616F9EF8004E0B25A4B9993F2765B7F391E2ABCC44814CEA30A4BD3541D855BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929136, "uuid": "9e344159-fa4f-4015-8023-08953db25212", "value": "768:ZEdp4Qqa7uIagfAWAACnQSJ3pop9JORSmoZE/EMELSV0hvNKQIXEqYFjA6Ad:2TSaC2AlRppRSmsu1vSvNKNXEqJRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771929136, "uuid": "d033ec4a-3c25-44f6-883d-9eec015720b4", "value": 83128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771929136, "uuid": "508a7cb8-8f93-4e97-90dc-60b8fbb03071", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771929136, "uuid": "6048f98e-7907-47dd-9eb0-5ac1c323be55", "value": "statement_of_accounts_3_022420261829_docz.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcfc341-119d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771950243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950243, "uuid": "16bfd9af-df43-4ed1-be91-2446a1b73784", "comment": "Malware payload (Mirai)", "value": "a8d52b4ab8fb36593634357488421d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950243, "uuid": "13317fdf-f558-48a1-8802-8aced3f99608", "comment": "Malware payload (Mirai)", "value": "fe7f47c1447e9d48014ef6c1853b06c94554b2f93185ad5e0a94d2da7086222e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950243, "uuid": "420ea5ba-6879-444b-9012-0401c57bf679", "comment": "Malware payload (Mirai)", "value": "40a91b216116344d7efd2d04344ac425dbb7d1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771950243, "uuid": "601d7da1-4e47-4956-9fa8-3c807aa60ca9", "comment": "Malware payload (Mirai)", "value": "48bee4c053920a33f6cac7c1d4194070b78e3df048e2bb31a215d979c0610468c026d78544be70355c4b14ae64d17d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950243, "uuid": "978b9650-3940-444d-b5df-69610a6baf87", "value": "T143F30845B8519B17C6C616BBFF4E42CC772A1798E2EE7203DD256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950243, "uuid": "7919fbe3-18f0-4b1b-af9d-6eaf99c15bdc", "value": "3072:fSCPWcWUyXkClQLSOI/WvEh9gThn1453yXCGrMHZmlz:fHPW/UyXkCqLSOI/WvEh9g1n145iXCGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771950243, "uuid": "1a2d63c4-323e-42d8-af80-4145b9b2079c", "value": 164056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771950243, "uuid": "0665831a-06a0-4716-ba04-ede4471a1235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771950243, "uuid": "4d862a45-3c5c-4a75-9358-2e9b16790b26", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e1b987-11b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771960731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960731, "uuid": "0ab45ea8-817c-4bd1-94e9-bfbe2dc03f44", "comment": "Malware payload", "value": "93caa1eb307df0d4847c8f7425e7379c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960731, "uuid": "cb23c337-ee70-490e-bea7-d90d92ff230a", "comment": "Malware payload", "value": "ff03dc52da81643d1347859f88b30a9330c5b60c6d8accdd865f6b4cc73b2de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960731, "uuid": "5d2faade-98f9-472d-b9f2-d5567ca7b32a", "comment": "Malware payload", "value": "3705f962dd99f2dca009199765f6c8cdb389910f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771960731, "uuid": "cd04d455-f222-4347-a64e-cc590cdd185f", "comment": "Malware payload", "value": "861877459f87f5dd2b0cfe53f75a0a48d28a200cd909538a830c52998478c9c924eb356c8ec4a1534838428673d608ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960731, "uuid": "56f9d731-c202-4083-9068-958787d20471", "value": "T13EC53956AD8A49E5D02DD336F9A2A5B97F35BC3C1B3223D72B4076382E726D41C36B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960731, "uuid": "bedee93e-7b90-4113-a95b-6558b7ca63b1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960731, "uuid": "10f52ec0-51d8-4b01-9417-ee21aab3a649", "value": "49152:2jIpm+uiBtQSSI7trrnX+QxWEwob4pKK/fOGV:2jRtKQ2gqwob4pFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771960731, "uuid": "71657cfa-cb0e-480e-bf04-00c6f36e20dc", "value": 2535936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771960731, "uuid": "6a844bca-7a36-4d8a-aab7-b0a1f9996ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771960731, "uuid": "bb0c790a-3aab-4a4a-83d8-4e6150c36d7e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1486a1-1152-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771918223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918223, "uuid": "8510463a-db66-4d95-b46b-23b3ad891622", "comment": "Malware payload", "value": "5698a896509ca2b2deb102d6d3803ee9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918223, "uuid": "b54d360c-c242-48c5-8853-c45d79607148", "comment": "Malware payload", "value": "ff24138b6d70fc0ce1142188ac799c743ac0cd16344fc4d515d82fb9fd475f4d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918223, "uuid": "8fb24243-113d-4c0b-a26b-7c55ffe09803", "comment": "Malware payload", "value": "6c07ee36d43dde4c9fc13fab75b92b22550d85d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771918223, "uuid": "3a346aae-22c8-4455-978e-81d9bbb30a23", "comment": "Malware payload", "value": "a0d48519d9a924511a2ef87d4469c38cfbaafa9b5bfddede7e6bc65deac185180edb27e2c7bd0cc29da11aafbe758c7c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918223, "uuid": "6d7b1626-e6b2-40e8-9638-6f65076ea374", "value": "T193924CB506497C79BBC0CE799F3C7F0CAEE582C42129E39DBA1F3A704A2165DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918223, "uuid": "666bc3b4-b58d-4165-9e54-27f85add7e5b", "value": "384:UjncuxOLnVYMSUzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:UguQL+UzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771918223, "uuid": "b997ff69-ecc8-4e7a-a1ac-dd79ea422376", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771918223, "uuid": "55ed62cf-ea11-48b0-bfc3-764b82b292e8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771918223, "uuid": "c3169c78-9b85-4835-80a3-2a5ccf9921a9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe91efc4-1124-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771898601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898601, "uuid": "339c8572-4017-481c-b19d-3830f123c1ef", "comment": "Malware payload (Mirai)", "value": "7561a982f0b5291c102a22b6a7124569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898601, "uuid": "dab0d376-b659-4b58-a293-6b9da1c92f6b", "comment": "Malware payload (Mirai)", "value": "ff268fb324b69cfbf60d93d5f214e0a935fe6dc117f62a91c43b63e297226a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898601, "uuid": "dd359c53-85f0-4995-b353-50ee73d4f43b", "comment": "Malware payload (Mirai)", "value": "cbacab75d3a54678765ccf61db084168e801423b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771898601, "uuid": "79c38f60-3327-4378-9b93-2a3954917078", "comment": "Malware payload (Mirai)", "value": "2a38b7280e9c20af4aaceb7ae082bfc181f161f5237be60316bd0ca3bccc3340c6e61aec412f456e953d6d8c1f058494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898601, "uuid": "74049f41-93dd-4f68-a082-4af5c59f4963", "value": "T1C613E167E0B00B03ED1EB5301DBAB01E49F5852EFE34A8B3D9D8F07AD595F8849194D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898601, "uuid": "485991fa-0ebf-4381-b96e-c94c0888312b", "value": "768:s4PgzPW3vSyhZxnOEQTWASbqyHKOAhB/e3FWoqMfnbcuyD7UHQRjm:dPEYSyHBOEQyPbJKOAr/ecTAnouy8Hyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771898601, "uuid": "b76c20bc-b8dd-4da9-9b48-b119df0d68e9", "value": 42068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771898601, "uuid": "0eaa729a-cacc-40ae-ad17-effb72f9a93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771898601, "uuid": "9ffc3bc8-7d7e-47af-89ab-89e5f2f66d83", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }