{ "Event": { "published": true, "date": "2025-04-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-04-06", "timestamp": 1743984182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "410a6ec2-88c4-4c88-b5c1-503454ba938d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bea8d8-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924597, "uuid": "3cda1493-aa6b-4f6b-96c8-a31d6cc9a9c1", "comment": "Malware payload", "value": "67f6cadd89a7e2ddf2262bc1666eecfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924597, "uuid": "726aa37a-9aef-4b54-9a2b-0f1088040ac7", "comment": "Malware payload", "value": "005f8860aebd655d7cb37dcc337a13292e84afd3f074b6e1e9e4c5a78a3150ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924597, "uuid": "f5609c6c-45bf-4531-87e4-8f1f5987a95b", "comment": "Malware payload", "value": "796dd51682ade75b5a1109835f01c68e087b3721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924597, "uuid": "20144d31-b0fc-4e57-93c9-ea0cc9daba13", "comment": "Malware payload", "value": "0b323856c141afaa5ee00ae026ef2c8da142af2cceb6d0564f141305c94dc7448c1623d46c11a34c214e507ceb27ae16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924597, "uuid": "f378f170-a9de-4004-8623-6dd6a5551616", "value": "T18D470211655E88257FAB5DF388F7353BF80E447D6D8BB16BCEBC122270E403126AD266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924597, "uuid": "07b7d5f4-d9be-426b-afb9-7b8821756bf5", "value": "75a7edd5e27e3873db683bbba6fe50dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924597, "uuid": "20ac0da4-a362-481a-a469-1045041b8ec4", "value": "768:HhHfMyLPARDxa+NPRhUmemH38+bLrzraw2gK:HhHfMiAFxa+5VemX8+z2gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924597, "uuid": "d830a7e7-723c-4244-9011-be7ed06f637e", "value": 25209203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924597, "uuid": "5f89d90b-9ef6-4e6f-b27b-4aeb51dc64d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924597, "uuid": "8ee3e4e7-5afb-4558-879e-ccfbb8d1122e", "value": "SecuriteInfo.com.Trojan.Darkshell.25792.19304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b686a8bb-12ac-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743919345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919345, "uuid": "918b4644-4370-418b-8dc3-7ace58e40925", "comment": "Malware payload (SSHdKit)", "value": "81c75dad93c8569363cf284aac254e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919345, "uuid": "bde89d66-49d0-4620-b6c8-7d7b53ab66a3", "comment": "Malware payload (SSHdKit)", "value": "00fb7d20406252dfadfde1ecb2e2ce81f3b17b332c222387fb6aa6ca3e8eff66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919345, "uuid": "8277894f-b79f-479a-ba65-4b0fda506f43", "comment": "Malware payload (SSHdKit)", "value": "fed06fb662925de09061514d1be9ef79c69c0550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919345, "uuid": "78681baa-ea50-4906-9c16-72b481129a91", "comment": "Malware payload (SSHdKit)", "value": "fccd63afee98780f2688a3442b450bc71f58bdef55a57a3fd4716791b67db18ee2e115028e2a8200af36a59bd40bc86c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919345, "uuid": "8d015575-b792-4559-951b-b992920f52b7", "value": "T1ED356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919345, "uuid": "d08faa73-c70d-44f3-92b2-664a78bcf5cd", "value": "12288:E8dASOYRNqAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbb0O38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743919345, "uuid": "0d0c7044-bdf1-4ee7-bc8d-d25360d6e238", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743919345, "uuid": "ef13db65-59e1-4bf0-9cf9-7e20f3095237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919345, "uuid": "4f13d0fc-dd73-4402-9f47-f64d6011bc23", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98566ec-12b5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743923242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923242, "uuid": "998c3f57-5ef8-49e7-84bf-ec43cbf37223", "comment": "Malware payload (Mirai)", "value": "f4b8a36850bc57dba93c57a1478adbf9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923242, "uuid": "6883212b-1265-424e-87d3-2d16ad5ab259", "comment": "Malware payload (Mirai)", "value": "017dc90a3ac5b9e4382fab481bd760fc008b76bf55632192b97c4b4de721a887", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923242, "uuid": "ac48a8e0-5cb9-433e-bb10-88fc7088c02a", "comment": "Malware payload (Mirai)", "value": "63de49235fc24cf3c27561a3640e01946773e104", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923242, "uuid": "026c8193-e793-4c4c-8221-1bb86bf7dedc", "comment": "Malware payload (Mirai)", "value": "684e416144c52f3b9c3d310054860f1afbf45fee9494501a1aec5e68b428c28b447cba8677c9e729d0c829e3bb3417e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923242, "uuid": "a461abfe-419f-40c6-8f98-3b2ec3283e0e", "value": "T1AB3107895296DF716D7EEB23B46FC1187682A08198E96F42E0DCB6E091DED1461807B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923242, "uuid": "3ebad6b4-b8fb-48f6-b165-bbf62e0f6acd", "value": "48:7D+7t7qYD+X0YD+mkIYD+izYD+fHMYD+2fYD+/MYD++XYD+RGYD+w5YD+7PIYD+a:/+7t7qQ+X0Q+mvQ+izQ+/MQ+2fQ+/MQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743923242, "uuid": "e9640627-2e58-43ff-8adc-495334db455b", "value": 1854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743923242, "uuid": "3b5fd577-b159-40f9-bb2c-e33dce418f79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923242, "uuid": "28ce3d8d-4b0f-4691-a94e-a3dad698853b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8de712-127f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743900113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900113, "uuid": "daee2d8f-c1da-4596-95be-ddc83ce2acd4", "comment": "Malware payload (Prometei)", "value": "cde77bceecdb481d6e72baccfa7d2c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900113, "uuid": "e25fe215-95a0-4ed2-980d-8369781a3416", "comment": "Malware payload (Prometei)", "value": "028c257fcf94013cd2e7ab45434d1893d4f0751286693901af81db662a1ee304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900113, "uuid": "8a39f3a9-3b04-4058-8100-7ea9c8e8632c", "comment": "Malware payload (Prometei)", "value": "7d179da4eb5cacb30195211bb50137ee7720627e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900113, "uuid": "8cbe69ae-5065-4c97-8933-4e5ead864b7e", "comment": "Malware payload (Prometei)", "value": "63c8cb7abac63ea8024339bc8264306e795fc72f649ace78d5ec26adcb13a6514240a45057aa3462c0070ebb476c3c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900113, "uuid": "bfa48576-cbf0-49f1-ac6d-00f3210a4c7c", "value": "T1EB9423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900113, "uuid": "b39e8435-5814-4dc0-b9ec-5da89afbb4d9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900113, "uuid": "aa47aa1c-6939-4611-81c9-a4459b00d934", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900113, "uuid": "8177ec66-beb8-4a14-9371-a61e32473877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900113, "uuid": "aae3efc4-9c90-4e34-b223-2c035ed30fa1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddefa1ea-12e8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743945181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945181, "uuid": "1e5b432b-e2d0-478e-995b-c285d49dca68", "comment": "Malware payload (Prometei)", "value": "d3f46f628e1a6eed2b66cdc61d74a147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945181, "uuid": "656f4da7-6f60-4ef3-90c1-ed203d842ad5", "comment": "Malware payload (Prometei)", "value": "037365fcdfa52f9b32646bf460239205e83031d7e74c7396c5018a733e50792b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945181, "uuid": "a4be718e-abd8-481a-84a6-5434a71c970b", "comment": "Malware payload (Prometei)", "value": "2a4ae926c600c6a6f42e0e088c1f0d7569d8014e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945181, "uuid": "7ba05317-d1a1-4bf5-98dc-214efb63fb54", "comment": "Malware payload (Prometei)", "value": "cfefd8dbc5639ec55c2bf89e8975a71fcc7b9cdad5ee542a04f1076c398791d4807a63e770439ca9de5882029c19bffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945181, "uuid": "0ded77ff-51d5-467d-8ca6-8967ff0c7778", "value": "T1DB9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945181, "uuid": "7759b1a5-2822-444b-afd1-20449d306bee", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgb:25WOSACZSV6eKRH5EPiamb4DsDwwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743945181, "uuid": "60dc23a6-beb8-4ed9-9e90-f95833102bdc", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743945181, "uuid": "8bb0da29-e1ca-4e1a-b624-a3c5527b38cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945181, "uuid": "ec76410c-383d-4e3c-a614-8abfa9b84200", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57266e81-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918326, "uuid": "2f824dea-91d8-4cfb-aad0-ec0b826e3acf", "comment": "Malware payload (Amadey)", "value": "055cafebde85d5599bdde2e005d87e7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918326, "uuid": "a9d1a631-9175-4e74-9145-16d000b381e7", "comment": "Malware payload (Amadey)", "value": "04276f6cc92da081cb3e4a1800f6e9b29bd4a491e349d564ca19126eafa2b0b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918326, "uuid": "185040d9-aede-4c1c-a244-c8e4aa15bde4", "comment": "Malware payload (Amadey)", "value": "d3cc9c91e6b59835b9b29bf692cae593602bc6ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918326, "uuid": "a716ac83-6775-45a2-b725-9a2dafb7eba5", "comment": "Malware payload (Amadey)", "value": "bf4bc30951f1da63a1fae103febf0ed7471002b0a37c176ba06489492e9c2d18fcc3d4a1b4e49af75f2333a1c087ebe3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918326, "uuid": "7506d1c9-4b3c-4d28-a864-d2c442cdaf34", "value": "T1AA66337F2948912ACADAA330B57781C304F276936DB4B15707C66A5A403A5B7E4333BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918326, "uuid": "1d903a66-c9ec-4d13-b64d-3aa77a52a442", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918326, "uuid": "2bf53d9d-8e32-494d-9de6-e29e75f90423", "value": "196608:AtbtRsluacAgdNFlDJPZ9RXtA56YB4FB:AtbtRjnlVx9NWI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918326, "uuid": "ddb41eff-10b0-4ab3-97ce-3fb0bbaa4013", "value": 6523392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918326, "uuid": "c61ff338-74bd-459a-b61d-624751a63f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918326, "uuid": "9b45e086-c089-4f8d-be10-2f67d68b043d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781d51ea-130a-11f0-ad17-42010a9c0004", "comment": "Malware payload (StrelaStealer)", "timestamp": 1743959613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959613, "uuid": "ee9c6d7a-bd53-4aee-a35a-3559a58400df", "comment": "Malware payload (StrelaStealer)", "value": "499ee4b114b59c9743db0e8e12c42e00", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959613, "uuid": "271aba41-5517-4cc4-9646-fd0b5d214c9f", "comment": "Malware payload (StrelaStealer)", "value": "043da7a869ddbde92c6438d8a441b84cd64fc704f9a1b17641d40e98a1ced077", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959613, "uuid": "b2921248-0326-4718-b5cf-23633fac2927", "comment": "Malware payload (StrelaStealer)", "value": "e8a96fd7d2c0d058b486cf1bec568efea2574398", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959613, "uuid": "42b00496-9129-4777-980a-efeb23b3da45", "comment": "Malware payload (StrelaStealer)", "value": "9c2b37c37a7db47ac7d83941fcf874ee6b052af17d4ca13178994ab81d88bbf6ddf06ba89ae6eb53789a5479693a2b59", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959613, "uuid": "6ac42ae0-5a32-43fc-80d6-cea3f1c3fd05", "value": "T147513F012BF80761F3B68A71087AB2206E32BC96E951C76E1490438C0872F14DE2AF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959613, "uuid": "2c0674a6-314d-4a4b-9b92-5ef15d046bb1", "value": "48:8gjmMEzQKrGWeLMeTVdLXuHz7Jk7gF2JqsQ+v0YW+:8gj7Ow4efuTWsFCqsQc0b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959613, "uuid": "c3dea6ed-8cb2-4300-a3d7-d1ceb9296b8b", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959613, "uuid": "dbaec5bb-f935-4260-9b1f-1041d279e4dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959613, "uuid": "91c1c318-7a99-40db-a203-745ce7069f12", "value": "RE_005859358438475.pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacd7d43-12e1-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743942169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942169, "uuid": "8c77e090-2a17-4fea-9213-c27077e050bb", "comment": "Malware payload (LummaStealer)", "value": "eb5f7639343687b99060b8615bd4f753", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942169, "uuid": "d4ee0804-064d-4a41-840d-5e98b0cf7fee", "comment": "Malware payload (LummaStealer)", "value": "04c6c41fc57624bf9c99a9cc78dd69105b4f35b7bc7a544b0eac18970d795e42", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942169, "uuid": "c0bf0599-1a75-479f-9576-9fca8e93869d", "comment": "Malware payload (LummaStealer)", "value": "2673a70fab80a94ab6d693ea9abf0472f49aefa9", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942169, "uuid": "38e1bd67-069d-4b54-8dc9-c51f8de836fe", "comment": "Malware payload (LummaStealer)", "value": "968939a8ba444e247398dcfda6ab95b4ab39209573c0973cea64e83c7d0fa2480d5cc006c285e8b1c1c4a3b68f720890", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942169, "uuid": "457af956-9875-4a5d-b71d-bbcdb45d77c1", "value": "T1C04523CB0B31503BFEE10DBEA1D1C44BEAAB7E6198D5154B317E527D75E078286BC122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942169, "uuid": "f3105136-ebf9-4e07-b691-c80b45a87e7a", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942169, "uuid": "d664c34c-7cd9-4a90-b4bf-634e10f7a461", "value": "24576:r0acSjyYg2gtD2qZUAh3hJ4QkkrB7VKIvnYDO1bl6a:ri/YgpDCwxaE7HnY45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743942169, "uuid": "0fc5ca56-2c3c-445b-95cf-6181359ac272", "value": 1175965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743942169, "uuid": "8438bf65-98d8-4cfd-83fc-b8026128df8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942169, "uuid": "c1364565-1121-4592-a007-3932bfdc0f10", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7da479-12c9-11f0-ad17-42010a9c0004", "comment": "Malware payload (njrat)", "timestamp": 1743931517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743931517, "uuid": "49a1ab81-43dc-4aba-a511-ccc820c5febc", "comment": "Malware payload (njrat)", "value": "cc0b15fa4b1b22d9199456364fa75654", "object_relation": "md5", "Tag": [ { "name": "AESImplementation", "colour": "#21D2A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743931517, "uuid": "295e4700-88bb-4edd-8e9d-e6d308c5d7eb", "comment": "Malware payload (njrat)", "value": "062a5fe8dbb7263423302916f1c5b845529b85e3d202c98143ab5eee1882573c", "object_relation": "sha256", "Tag": [ { "name": "AESImplementation", "colour": "#21D2A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743931517, "uuid": "67de9845-d112-4d9a-86a8-cb26ebe38afb", "comment": "Malware payload (njrat)", "value": "0b917c4ebc96d61a9612fa131b19dd96fd65caa2", "object_relation": "sha1", "Tag": [ { "name": "AESImplementation", "colour": "#21D2A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743931517, "uuid": "e9db32cc-64da-46d5-a0e3-f49e5f687bfd", "comment": "Malware payload (njrat)", "value": "352df3c490a07e18955f39f957c9a1e273aa50973a52702aba6a31fbb9070b727c8cdcffc990bd186537095222fd4941", "object_relation": "sha3-384", "Tag": [ { "name": "AESImplementation", "colour": "#21D2A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743931517, "uuid": "2a1eadef-9e1e-4d8c-8085-03892fa53961", "value": "T1A6B219487B558612CAEEBFF125E3610617B0C11BD903EFAF4CE489F17B57AC146502DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743931517, "uuid": "64790a26-7fbd-4a87-b074-ae3e382576c2", "value": "384:AlRmhGD91SluSWhnHHxzLmY63Tm2eaFObpzRApkFTBLTsOZwpGd2v99Ikv:0RPD9OQhx/B63Tw42pzVFE9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743931517, "uuid": "3130d591-dcde-4d6a-8c3c-77fcccd7a243", "value": 24557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743931517, "uuid": "8e3e4050-fd25-4384-a8ae-c0079373ce66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743931517, "uuid": "8d610fe8-8bd6-44eb-90da-ea0387fedbfe", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317cf634-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918263, "uuid": "74dbc685-1c8a-4e72-8c8d-b42c319da5ea", "comment": "Malware payload (LummaStealer)", "value": "a4502db4113a08a5c6ec19e6aa2ea8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918263, "uuid": "f6492b1a-ba4f-4904-b6c1-47e7b43a6825", "comment": "Malware payload (LummaStealer)", "value": "065abd35df7610c4cd8695a81dc025bb010da9b969008f024b99fb0b9e74cfa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918263, "uuid": "ebf9c360-6e01-478c-8160-13a8c469d6f1", "comment": "Malware payload (LummaStealer)", "value": "ebed9e92b2855a9869ad3ccc4b936fed00961001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918263, "uuid": "2d85601d-b7ba-41b1-ae22-d7e6c777f304", "comment": "Malware payload (LummaStealer)", "value": "3c6c4924e4bd3a8dcf8916103393c3dcc1e99c7f38834ac1317f1b83e7f5a39a60ad338fa0eee4d686d99571c43686aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918263, "uuid": "e8b33a71-a0b4-49a7-9280-e824c10dce3f", "value": "T1029533D72B7CB694C46F26F2C8DB4247B83D4E200CD1AA51BF81593A998335952B9F3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918263, "uuid": "6c50ad4d-236a-4793-b55e-d26dbd5c2c3c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918263, "uuid": "ab70482f-6bff-4051-a3b1-cd58dcc243d6", "value": "49152:Ijj8aCLocHIJ46Ezgryf94X2RYNbBYr9/ulG:Ijj8lL9IJBEMryVRYtyr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918263, "uuid": "1934d83d-a6c2-4e98-902c-c7f96d958d7e", "value": 1907712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918263, "uuid": "6534f58e-5aaf-47fa-9867-71650fe697c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918263, "uuid": "a124f661-bd6b-4492-87c6-44945a613642", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917b06a5-1325-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743971252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971252, "uuid": "6a7a2934-2bae-4ed2-993d-5bafb7797dd2", "comment": "Malware payload (Prometei)", "value": "d2c0c0358532fb1df303f59d22e68461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971252, "uuid": "fc965311-8b53-4b6f-88b0-cd554606f87f", "comment": "Malware payload (Prometei)", "value": "07ea5257dcf48290c5ff746ffa70396adbf53eb987beb303541178ced98f7705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971252, "uuid": "ef5e5411-9608-4ec6-9f83-c7ff407a94cf", "comment": "Malware payload (Prometei)", "value": "9902f9929b4804d1b06d339836a931f9b27d6a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971252, "uuid": "2dd46af4-3fdd-44f0-b6ca-3e17565ffcae", "comment": "Malware payload (Prometei)", "value": "32a7ed3ea9ed30ee9aa5b3f686b9a65f57503f61d77870e272a0ef101487f2f5cd324a5ad06e3e57d818a2fda50913cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971252, "uuid": "085c61f8-1780-4021-b819-89c802b70b7f", "value": "T12C9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971252, "uuid": "adb5cca4-f16b-42bc-a5a9-fd1f75b32a3f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgo:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743971252, "uuid": "16eb2987-eaae-4a03-acda-e326ffcfa75c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743971252, "uuid": "b0633e3d-5098-4d5a-87b2-b0e4b114acd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971252, "uuid": "9cf42680-8e75-4e68-a1a1-6dd1d4098c04", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4105e5-12b5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743923244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923244, "uuid": "46f8cc1b-3281-4ac6-ba9c-24ded77f832c", "comment": "Malware payload", "value": "3a36f8dc3dfb173736dd7d96318852b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923244, "uuid": "30a6edde-1aad-4e89-8fb2-c5b2f2a3f23c", "comment": "Malware payload", "value": "0863ccfab8853a558ca1953362c94c8e47d18d52f15832935a6cc1ae185d4e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923244, "uuid": "e0d9967d-4cb5-456c-b70f-82fac647625f", "comment": "Malware payload", "value": "eac1f3c9911817759c1acca9f8b909e69879adb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923244, "uuid": "00ce8825-0efa-4458-b318-ba129a42a65b", "comment": "Malware payload", "value": "83cca0419bb0836fc65b23831c0f72ba853914362e6bc0639ebd59c1615cbd2b442b609b1243b8e94367d5a941bd2ca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923244, "uuid": "1b5a32ef-1257-493b-90b1-fe6815168ee3", "value": "T176B3F899B8919F66C5D506BFFE1F828D33231BB8E3DA7103DD146B24378A91A0E6F441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923244, "uuid": "8d6a6e36-3d4b-4f2e-aa32-f3185dc6e11e", "value": "3072:6qE7CGICtpZ19kOcIk3UvNIpWG3nQEYulEQhfhNsdu:6qE7CGICtphRq3iIgEY0EQph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743923244, "uuid": "3299c4b8-738b-4c1d-986f-9313fcdefaa8", "value": 107640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743923244, "uuid": "a11b93ae-2143-478a-919f-6cd5cb2cb74a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923244, "uuid": "d4680d99-42c6-4cb0-82bf-566b1d16b51d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acc42d0-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918198, "uuid": "aeb288ea-54d0-43ef-94f5-8f42735aa84e", "comment": "Malware payload (LummaStealer)", "value": "d1fea7f3bc108be1025886ab39345980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918198, "uuid": "53f319a8-699f-49a9-9a2e-ae67f89e796c", "comment": "Malware payload (LummaStealer)", "value": "088bac1a42e949be40acc5e113c6ed022c874062dbc557107cb6d3c9c3684c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918198, "uuid": "ee4c3ea0-d9d6-48d8-8822-d45f9beec942", "comment": "Malware payload (LummaStealer)", "value": "2e7668b59da63c462e373603db5fd6fb87af2418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918198, "uuid": "185fe340-7e5d-442c-9325-9f4552b719f1", "comment": "Malware payload (LummaStealer)", "value": "993f1109e2c4aef4b29d68f8c89671aead2126a9c79a2e30ca57c41905df75aa90b9aa557d1ba600ef7871752bd3ce3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918198, "uuid": "afd0b8ba-56af-4054-b38b-b7f8e8808216", "value": "T1229533D4AC074B7CDA041BFA5BE64A13E1DD8D52FA3D01ADE1A23FA6D400B14627DB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918198, "uuid": "40030af9-b0b7-412b-b7c4-3f6d42e87f53", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918198, "uuid": "8de51fd7-ede6-4e40-b195-5129b1ee0cb5", "value": "24576:P9TzoolEFWkZh2Vm4ahceJUDDgZ7R1RXhPOPcH4zplOaKmc08VBX5MqJd9lAAEi6:Pi6ERhZh4D0ZZXhmPRKmc0sJd9iiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918198, "uuid": "04785005-f71c-47ad-a448-b14b180acbe2", "value": 1890304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918198, "uuid": "dac1f952-df41-4a24-9947-9784078003be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918198, "uuid": "47505eca-7699-4f1f-a05d-232d3d2767b3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2349a30b-128b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743904925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904925, "uuid": "c8a0210c-4e1c-4537-bc1c-c46e338e4dd0", "comment": "Malware payload (Prometei)", "value": "e47b9affdf30e56a2fb6ad265e31facc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904925, "uuid": "1a90d11d-1b4e-44ad-aa30-5444b8ee7b97", "comment": "Malware payload (Prometei)", "value": "09721625a69469bfd9a9634de99f3c17acd3267a288fce1c83a68726cab01fdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904925, "uuid": "4d90bedc-b0a6-48c8-a1c2-7d178697cc1e", "comment": "Malware payload (Prometei)", "value": "9588b137ec4a099250f41361a14aa0315a5c067d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904925, "uuid": "adceda9b-f2e4-441a-9960-876602747f93", "comment": "Malware payload (Prometei)", "value": "9e1d466522027b424c79c0af951395ade5e4e481339cb72cc7127a77422e0e586416902f2f9abcce9806c36f6daddf16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904925, "uuid": "af27eaf3-b749-4e2a-9da9-cabe51ac8174", "value": "T1A9155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904925, "uuid": "f8b47549-ede4-490f-b232-468bddf64713", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl5:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904925, "uuid": "0b0cb127-d100-451c-97d0-1343898463cc", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904925, "uuid": "0dea780b-801d-4736-821b-cd92cecefaa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904925, "uuid": "4d067a69-4c49-447c-b08e-5271e461d25e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd93fe55-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1743934067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934067, "uuid": "68886a44-5313-42c4-b257-6c84c38be896", "comment": "Malware payload (Gafgyt)", "value": "8bb3ceb42fe00258d048b1ea479dc8ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934067, "uuid": "27dacdde-f59d-4945-9453-4e5da9a6b599", "comment": "Malware payload (Gafgyt)", "value": "0b540ce061840ccd567120f3a88e741c61a144c20d69c401b193ce64b7eb791c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934067, "uuid": "7e3b24ac-9ca4-42f5-a178-bbaf0d969410", "comment": "Malware payload (Gafgyt)", "value": "f6a2138aaaac7d15425ad3ce91521a06fa4b9f2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934067, "uuid": "f4919ae2-9271-4f94-8e26-76019fa3ebf2", "comment": "Malware payload (Gafgyt)", "value": "acfb54b78ddbdefdc5a5bdce06729c4d7d03622a57c1a471935986dc85d5f04611737045f2691d3e24421d6e893c4e31", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934067, "uuid": "4937e254-6db1-41e8-bcb0-a159af2b7260", "value": "T15D21D8DB72A206796C69BC3B757E8406B4D0909750E75F486CDC38F945CDE0CB100BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934067, "uuid": "3b5e86a6-d2d0-4ebb-91e0-1da3c681b4ce", "value": "12:z0Fxi0FpzA0FnNIh5L0F/G6i0FJmjvWo0FKScZ0FM0FsMKRz0FLc4E0Fsvu:wx39xnNIfY/TJmaJKqFsMFLc4N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934067, "uuid": "c52b4c7d-69be-4690-8830-1e3b9e6502e8", "value": 1292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934067, "uuid": "473e930f-5274-4b66-b3d9-714fd6792ea9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934067, "uuid": "9af44731-a7d2-4367-9aea-d783b1e450ee", "value": "nigger", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc12a0c-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743938953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938953, "uuid": "eb4c0a1e-9a4a-41db-93d3-2065f8ffe0a7", "comment": "Malware payload", "value": "0d40b55e1f552db81c2b8400e1f25558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "Stealc-v2", "colour": "#4DAEBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938953, "uuid": "f0632886-6bc1-4e6b-898d-ba9ca1b62840", "comment": "Malware payload", "value": "0b921636568ee3e1f8ce71ff9c931da5675089ba796b65a6b212440425d63c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "Stealc-v2", "colour": "#4DAEBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938953, "uuid": "03bada9b-7d30-4b60-ad48-4870c16d5b21", "comment": "Malware payload", "value": "0bcd700c0e72488bace860b61e91e828df7e660f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "Stealc-v2", "colour": "#4DAEBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938953, "uuid": "b9683ba5-75b5-4916-9d1c-dadc14f5b188", "comment": "Malware payload", "value": "d56840538dc0fa6288032daf15feebfbe362e33cc060639785101ea9d6e366389b8fd0650cb96e7c1d0afc188f1c71ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "Stealc-v2", "colour": "#4DAEBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938953, "uuid": "0fc074cd-34d9-453a-8965-c95d7102f889", "value": "T11CB533DFE4B20C66DB0E00FC921E9BD8BF75674607A7A5EA1306509EE34725F139A039", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938953, "uuid": "0cd6b421-33a8-47e5-b074-bd3781755a7c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938953, "uuid": "7b14d5f5-5c1b-438f-8be2-7413fb32e7df", "value": "49152:OWqzJcHVidk/TXCZTLALg1T6smrTUxsbVUyBRzOKf4XOBQoBF:OvcQk/TydLAtsNxKXLQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938953, "uuid": "5b06f328-4f96-4c2c-81ca-dd3413e083a3", "value": 2442240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938953, "uuid": "e26ce102-1540-47c4-97ec-addcef81d205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938953, "uuid": "22dbce1d-894a-4bb7-89af-adebf7939a1a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2805a282-12ef-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743947882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947882, "uuid": "5314f372-8729-4f1d-b254-6203bf4d3e43", "comment": "Malware payload (Prometei)", "value": "b8fef7f950ffe5c20ecd9d2bdf84995a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947882, "uuid": "883d9a4c-8926-4874-a39c-028bb902d1b4", "comment": "Malware payload (Prometei)", "value": "0d042d775d0b550f4083f097daa28d4b59861c91e9f0861555519b11c1f8686b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947882, "uuid": "94a3e1df-44ab-4612-a79c-df91ddaffea5", "comment": "Malware payload (Prometei)", "value": "998d904e67791e9c4d4ef8d0c1e9404c15742dcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947882, "uuid": "fae5b6ad-f06c-44f9-97a1-89c6fe3d2c2c", "comment": "Malware payload (Prometei)", "value": "94e15067c3a0c1bfc33ffaee5027e3b0dbf86ec5db23c03fbaca5c90b9997cf95a1ad8d504e4b3995baa1a42e93639f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947882, "uuid": "b552d35b-7dad-4aba-a76e-31d93a4cf9ed", "value": "T13D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947882, "uuid": "382fb5dd-4690-4927-a30c-c6881b6bf872", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpln:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743947882, "uuid": "96204c07-45b6-4710-8fe5-0f1d5fdaab7e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743947882, "uuid": "a059de3d-14b6-4f73-8caa-8c2b336b5943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947882, "uuid": "a0b46fbc-b610-4f87-8f9f-10769e6efe9b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30df7301-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743917832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917832, "uuid": "8ca87ad8-643f-4fa1-8b70-86f584fae484", "comment": "Malware payload (Prometei)", "value": "be5fcc53f607359e7f1a19b40000be35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917832, "uuid": "8b3f51c9-6f8b-4e6b-bda3-58b5b9591f50", "comment": "Malware payload (Prometei)", "value": "0d1bc2f9e1eda89aca84080c7ab94aa53e92a72c8417b868a694efc842cf0528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917832, "uuid": "3034431c-981d-4e8f-ba7b-6e86d54de052", "comment": "Malware payload (Prometei)", "value": "80d8000b647bb29996cf1bd55881591667de9f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917832, "uuid": "66fe04aa-6f90-4e22-aa03-be6c73c521cd", "comment": "Malware payload (Prometei)", "value": "f347277003389d07deb88ef803f5245ba97f788fd2d8e1dc6010cad5be5a7c700f7b770ed84a687b851bd30fc8493a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917832, "uuid": "b39a4679-d71c-4d41-bb78-76747159e06c", "value": "T1D99423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917832, "uuid": "00f49ba7-9d3a-4211-8e1e-268ef652d528", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917832, "uuid": "283b6eb2-b1c0-4ac6-b03b-f31194074579", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917832, "uuid": "1c95e993-4c95-49ff-9b37-01805a6a2f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917832, "uuid": "5d0bbaab-b023-48d2-b08d-0e5cb043a0c4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9634593-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918061, "uuid": "f72c88b7-6390-4776-9b50-6a682d3cbdf7", "comment": "Malware payload", "value": "6115bf4d7021421eeba1b2a6287e56df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918061, "uuid": "1e02dfec-8b79-4814-94f3-6a9e69a6afd2", "comment": "Malware payload", "value": "0d883692406531dac4a7371d89b714c8d1eddeef56c1a3ea4ed602193d96f139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918061, "uuid": "d58cc93d-1cd7-4ede-bd76-e65994848a27", "comment": "Malware payload", "value": "ceb7a33dfd8ad8b55b41c4588a2776d758357ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918061, "uuid": "eb8f4fed-2852-48f7-a5dd-ca43503373e5", "comment": "Malware payload", "value": "d1e7a823c04fdbb31928692434664e884bfe5155c0965375746866c7ece970926e0926e17016118da045865f6d631828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918061, "uuid": "70fd1182-0d94-4f32-86c9-39009a62565f", "value": "T157B5336BFE554978C52F7A728E7B95072BAEB00001F4829E3B4446263693F0F7F4A85D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918061, "uuid": "c749025f-4fc0-4743-8151-a28cb3b1c970", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918061, "uuid": "d860dc37-4fcd-45d3-b28b-fd88dd1ca854", "value": "49152:YoYzq6eflYgKD8omp3rF+4Pyw64tsXA+hU6Sze9CqQk9ReUiAsn:oG6yzKSmdLwoqze9TQkfeDAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918061, "uuid": "ebbbbaf8-81af-4c0b-83a5-f74d2fb78382", "value": 2493440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918061, "uuid": "cdb2b14d-d707-4f16-9831-748fd99fe1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918061, "uuid": "81b0866e-3e25-4232-a7e4-7f4cab4b8474", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f87dda-12a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743915739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915739, "uuid": "32efcf55-e502-49c1-8b5a-5b59518e2534", "comment": "Malware payload (Prometei)", "value": "2f8ee2489ac6d61f2c2c84608387cf7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915739, "uuid": "0acc572f-ad67-47dd-8587-589a85445267", "comment": "Malware payload (Prometei)", "value": "0e8826b5ab1463531c34fd65487a6f0b2ca1c76a0188d0c02f6f7b6d3c273578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915739, "uuid": "2fb20965-4ec3-4db2-b550-91595e53f35f", "comment": "Malware payload (Prometei)", "value": "ecd311826ea780906ab55b2dd0f45384e186850d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915739, "uuid": "1dbb63f4-7aab-4bcb-a5d0-cef018ed5689", "comment": "Malware payload (Prometei)", "value": "5e795daa4fa2398f096868d443a29a6d271c3b614b059f00de784e8e90b5691facfa9f5066fbc89fb0996b81c91ad414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915739, "uuid": "fdc82da1-3cba-4030-bffd-28fdaa8612e7", "value": "T1B09423F8C83D2E3098169F3CBB5A826CF0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915739, "uuid": "65dbc6b1-b046-4dfe-b111-f99a55583b95", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgv:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915739, "uuid": "05c8e7c4-ab76-4104-b00b-9d2fc81964b3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915739, "uuid": "fe20b167-2a53-47e8-8314-5b5369ceafd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915739, "uuid": "3bb3fe51-4d0b-43ba-92e3-b862dcdc1db8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af155d82-12b7-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1743924057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924057, "uuid": "5f9eb611-b108-4176-ba81-5f953c955b5a", "comment": "Malware payload (RedLineStealer)", "value": "3ded2b22f85e0720a350969315ce9575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezoom", "colour": "#CF7716", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924057, "uuid": "d2a51063-f94e-41b2-97f0-fd18cbc27cca", "comment": "Malware payload (RedLineStealer)", "value": "0e9ebbf4391a1ce11ceecab0c0699a229a7f2a20b9909600310db15b1b3cf772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezoom", "colour": "#CF7716", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924057, "uuid": "698ae209-c661-4486-9b8b-4f87d9acdd0f", "comment": "Malware payload (RedLineStealer)", "value": "7177823472026652dd739aae3c73aec6e2f0b220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezoom", "colour": "#CF7716", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924057, "uuid": "51163535-60a6-46b2-8fa9-1fb9beda59b5", "comment": "Malware payload (RedLineStealer)", "value": "fe445ff06119cbf85e3c21735c8df2886292d2457c4b826be3e2b6e91c37f87af9cd78648307ef149b535e423d1fa4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezoom", "colour": "#CF7716", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924057, "uuid": "417dd5c7-8edc-45df-af7f-dfd34fc2e681", "value": "T10525D1FF61A72548FD724C30AEE8B660CB67287A8E16DAF14691E0302E351D3FC56917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924057, "uuid": "01ac39fc-2963-46ce-952f-09293aa63f96", "value": "06035ae23c96b8491975861b73ef8f91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924057, "uuid": "9972993a-930c-4345-824f-dfd9a58cbc93", "value": "24576:Fem/E/ob86A6X5EdNWbHh3v2V6X5EdNWbHh3v2st:MmsgIn+5ETwJ++5ETwJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924057, "uuid": "77d46f50-6a2e-4925-bcdc-f9f6af700d0b", "value": 1054248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924057, "uuid": "e9e16b96-7a8b-4f84-b5a2-2b3b1ee249ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924057, "uuid": "61437ddc-c7ff-4d3c-88b7-6b21f7d0662e", "value": "Zoom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f554d2c3-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1743918162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918162, "uuid": "0a968223-fdb7-48e7-8b79-dce14bcf3112", "comment": "Malware payload (AsyncRAT)", "value": "60f68052534a09ff64f0538600d68310", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918162, "uuid": "f244c003-9360-4a5e-9cb3-6a2e89bd5c0a", "comment": "Malware payload (AsyncRAT)", "value": "0f1073c5cacf5009f6097cf771b71ab18e3350fd445935ce72ac1b45fd175291", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918162, "uuid": "f653e084-4b9b-43ee-9d54-ee87e058d4ce", "comment": "Malware payload (AsyncRAT)", "value": "591d353d857395dd06e67126683d7b2d812c23b5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918162, "uuid": "8efa5baa-df76-41bb-943f-596621204d0d", "comment": "Malware payload (AsyncRAT)", "value": "f5f7828f5cf0c9a4287b8e22f9d42d95896c2e374a63e3d2cdf48de546a879410fd2596c5035600ee979c1e97b9401a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918162, "uuid": "7a4331d2-bb6d-4b7a-88a9-4c8eddf93737", "value": "T1D5B4AF60F75A9EC6D44E8E31DAFEB6B8F629786819448313B38C72125DA124CDCCC7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918162, "uuid": "cff85bfd-e920-4dad-ab36-b6161390f761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918162, "uuid": "a6819777-6aa6-4d33-b883-9f9977756bc2", "value": "6144:wgtRLl5KNCI3OkclAhQmLumUAc2qXfNd5SpMWV3LdR2ip/mYpm7JP:wSLl8Cq0yTabRO3bAYps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918162, "uuid": "da2ef6a5-d5c2-4c66-8815-78e9224f7e97", "value": 502176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918162, "uuid": "e5a0c860-5538-45e1-80a3-7da963bfb62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918162, "uuid": "1a4269bf-68be-4778-84db-af520d584d81", "value": "rh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea43417-12d8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743938283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938283, "uuid": "b1b3b797-8a27-4550-a2c0-a323c5139326", "comment": "Malware payload (Prometei)", "value": "4cd7094b0513f2b0e005155f4365f246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938283, "uuid": "dfcf9957-e221-43ea-aadd-9b2afc3b216b", "comment": "Malware payload (Prometei)", "value": "0f4446c3c08c0d74aa5ce9a5ff8389ed9a383f1017d9cb6d7abea0023c72f4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938283, "uuid": "30151f48-a5de-425b-80ea-b6687521e66c", "comment": "Malware payload (Prometei)", "value": "fa93368daa1f3a2117dff1910bf150aab4472c9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938283, "uuid": "ffd8f43e-c16a-452f-a462-c2851b0e383f", "comment": "Malware payload (Prometei)", "value": "0de307809c1f65e0f023731fefd74b15fcc0fe43e2b91c150cbf0df13a734b96fdc71889842111a4e1b7422be898b116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938283, "uuid": "c3df50fb-10c0-447d-9413-c4bad559e6bd", "value": "T1499423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938283, "uuid": "2fd553ef-cdcf-4926-9d11-23fe687bef6b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgb:25WOSACZSV6eKRH5EPiamb4DsDwwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938283, "uuid": "5379332d-8bbc-49b3-87cb-77816fde9575", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938283, "uuid": "6945b236-1bf4-4df3-8d3d-ddb4bae16500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938283, "uuid": "94f86e57-75c3-4703-84ce-95d26541e0a0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883048aa-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743938595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938595, "uuid": "e3cae883-0465-4be8-8d72-2c58b72b73e0", "comment": "Malware payload (LummaStealer)", "value": "d186c703e85fa3f4dfeeaaa48b1a83c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938595, "uuid": "2c06d4fb-1537-46d5-95be-1ba5e2c745c2", "comment": "Malware payload (LummaStealer)", "value": "0fac62c7bb069712650bdf37777e91e080a9d011ec241ee25f601ecb862b2247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938595, "uuid": "1a198d60-b25e-4ce3-aefd-43ded01264a6", "comment": "Malware payload (LummaStealer)", "value": "bae555b0b58f164a0e71416b124712055d55447e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938595, "uuid": "a5540747-6ae3-4a11-9301-83cdd28ab6d9", "comment": "Malware payload (LummaStealer)", "value": "6b6a8c808906a54873b451bdaafd9de7a5680b4981bd4e7025b79dcee808c6ceab732f8cddb492e114cab0baaab5ef00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938595, "uuid": "da0a7494-4e6a-4a0b-a155-4ea222f76687", "value": "T1D0A5237C8D215F67EF1E90F16CBFF7221A54218CE0023D4A3BE9635402796E525A3B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938595, "uuid": "a762f566-afd8-4d48-9e9a-e8786774df8f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938595, "uuid": "08578e32-852b-4a4c-b3d2-33cc5a93ad8b", "value": "49152:ZyOl2LaQqf5K6ZFRHglhL0i6Co6DurTFp:HlXQqI6XRHwwpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938595, "uuid": "36c86ec0-932a-4878-8d77-3baba98f651e", "value": 2143232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938595, "uuid": "15129169-9b2e-4ac5-a289-9a6bc59afc1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938595, "uuid": "1a811657-be1e-4316-8a4a-88d50dda7e3f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83846acf-133a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1743980248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743980248, "uuid": "a7c3fa6f-bb2a-42c7-92c3-e5d7e7ca3eb6", "comment": "Malware payload (Hajime)", "value": "5d6a933de70c5fdc5e91f5b8da9716f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743980248, "uuid": "5218a433-1246-4cb1-af0f-9fe5fcc5c74d", "comment": "Malware payload (Hajime)", "value": "0fac95dea4d85689ea8821e37dee8c7de35114ff5143c697f7b7da4c3127dbcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743980248, "uuid": "215b1cf2-6f75-4f5d-a899-e7c02b86e4c9", "comment": "Malware payload (Hajime)", "value": "de6d98c92c08da7da792d120c13472928d623ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743980248, "uuid": "b6507b1e-dba6-4942-9e9f-de31b25b0a21", "comment": "Malware payload (Hajime)", "value": "4642c0f7e12f8e4db1c8d81f2b1cce24aaf9239b09033c6d6eb068d485424f4a0ea18861210b2baee7249a8e01a89f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743980248, "uuid": "cee59837-aab2-422c-abfb-632900b58e72", "value": "T13613028236953F72D5214CF4D7FCEFCA614A7D94AFD9181BA8123A98B47135C28C981B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743980248, "uuid": "49d9d303-8025-4c42-bfc5-5c46fa2e4237", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsT:yYI0ARqw1qAEW67UIWi7M8gmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743980248, "uuid": "3fbad734-ce85-4de8-b03a-b2e8ebac5c9d", "value": 44416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743980248, "uuid": "80c99ea4-ee85-4e77-b09b-765f86b4a626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743980248, "uuid": "8e54e2a5-4dca-4709-a3ec-f6151d5ec41b", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa1f4d1-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915441, "uuid": "136e1505-aba8-49d6-ae59-115adfc911b7", "comment": "Malware payload (Mirai)", "value": "16e36bc3a092b4bbd75d62520bfdcfd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915441, "uuid": "d5763d28-ac95-4667-b1c6-b40d43121380", "comment": "Malware payload (Mirai)", "value": "108600ec1ea96a626b0ab744db139924815266ee988220274ea703a12f98e82c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915441, "uuid": "e2c037d5-2b33-4144-ac46-d879420c200f", "comment": "Malware payload (Mirai)", "value": "0b62474c0e8dd1c09f899dbca5bbdd5923ef1a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915441, "uuid": "a94aa5f1-2eac-4b4c-a253-ccb0bd0108c2", "comment": "Malware payload (Mirai)", "value": "b50ca8b2a30efa1881fdbfd2333267bfecab6be7f1df911a4a65ec2dfdd5f2dc8e8a289d9e824c2a79c46f2540d5ca42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915441, "uuid": "e45ddf26-72f6-46e3-a50d-8db4bf250f56", "value": "T17243F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F647B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915441, "uuid": "ecebf968-f5b9-4c07-86e4-4becaa0439e3", "value": "1536:RJng2Ke3tTQZoSgLyUpja5X3ez7IMix3JihBJ:Y1edT+dCWn3JihBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915441, "uuid": "e0480fc9-434f-4f64-b218-5ea68e8ea6d3", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915441, "uuid": "e8396c09-c0cc-444e-ab05-e96db29c3998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915441, "uuid": "c38d52d2-83c8-4f10-add4-e8654d4e7cc9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e38a0ae-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1743938873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938873, "uuid": "023d80dc-bb45-499b-90da-3ada40edc2e3", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "520cd97eb18d9ef5208db555f6894446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938873, "uuid": "0643044a-483b-4e47-b639-9b6182e2fbaf", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "10b455dea090336dc138e16df51083acd641e1aede1055fc527a6c3e22b79f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938873, "uuid": "f766e1a6-3259-4a0b-8d4a-dcd6ac436e1f", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "c09cdc1637572d9f4fcf25b296ad852b2d5a6cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938873, "uuid": "68a33328-a088-4144-a2db-edf17b55b09b", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "d1257cf371c719561a2e2e62ff31330324d5af220d7c334d02b41814d601f5576d6ead6370bbda88c5c1dcc0cad6fe50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938873, "uuid": "3e202686-2cbb-4917-8d34-27097eeb7e52", "value": "T17EA5331B29CCFD1FD8FD6B35C9EFBB06877050A853E1BB54492846A2D361790E32982D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938873, "uuid": "4714cb7e-4102-4822-a94e-dac878f29977", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938873, "uuid": "16b9e1e3-58ed-42d6-ad94-1271b03662d7", "value": "49152:FC3DDHM642wBmtg/CJXMBc77W1xsmvDAPEPDJBMpoXGl8ayVBB/w:lJXOpSAmvDAPeJBMpl5yZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938873, "uuid": "dfbd16fa-865a-4cbc-9c1f-98004098dd16", "value": 2172416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938873, "uuid": "0b33febb-10a4-4de2-80ba-2e24d623a265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938873, "uuid": "7ca83265-4c1c-43e1-953d-be3ae95d9614", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4258fa12-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924304, "uuid": "475e833a-1158-4693-9c5c-42ed20fd525e", "comment": "Malware payload", "value": "68ea5ce0cbc1e0f9c96fec4921fbb3ea", "object_relation": "md5", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "nvidiaupdate-zip", "colour": "#F8916C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924304, "uuid": "87c99a85-9fb1-4777-8d7b-07b5abd82280", "comment": "Malware payload", "value": "10e4c74df854f63951facfd589717be18b746befd9099e1d9083f0cb6cf310c3", "object_relation": "sha256", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "nvidiaupdate-zip", "colour": "#F8916C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924304, "uuid": "ea4891c1-5569-4e6a-bcf5-0289633f4a54", "comment": "Malware payload", "value": "a7a7a47c4e014a892bc670bb3468ae77da124945", "object_relation": "sha1", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "nvidiaupdate-zip", "colour": "#F8916C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924304, "uuid": "4411348c-45cf-45de-9d2f-958f5dfa803d", "comment": "Malware payload", "value": "4eec13a1e444e430f6e014552c2fea8690ac0d0ef291c530161f435af7e038b6c0e2e79e1d6d53d24a1ff757dc97f105", "object_relation": "sha3-384", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "nvidiaupdate-zip", "colour": "#F8916C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924304, "uuid": "e5d2de79-7fc1-4a58-9602-cea69a7e1826", "value": "T1CB4733F6C87250B32953C12D8B78AB5560FB909ECEA6483E75920EE21AC3FD91355CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924304, "uuid": "23dd3360-5c10-4750-b3cb-79a7ec65b8f7", "value": "786432:ITOgp62PMXIs05kBQItN0mPoVlai0TtRggr32:ITOgp62PMX3qIQINoD0TLggK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924304, "uuid": "96c60339-5aca-4621-81f5-3f06afb28944", "value": 26861282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924304, "uuid": "ddb03acb-3a66-4ce7-89a4-d2b83b62ab8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924304, "uuid": "53b887d2-8755-48f6-9749-6b7d74ed59ac", "value": "nvidiaupdate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f511bc-12bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743927451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927451, "uuid": "8f882b57-51bf-46dc-9ad1-22e563fb6561", "comment": "Malware payload (Mirai)", "value": "8453b06fad10d11c1cb105062c8316f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927451, "uuid": "a726c360-1323-4ba3-b78d-ce95af25f798", "comment": "Malware payload (Mirai)", "value": "10ea26655418ffdf096dca04b3802c75aaf27e10682f2e7a0f6a5daa965e1fff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927451, "uuid": "3dbacc66-9067-44b6-bdc0-7ad58a84f3fe", "comment": "Malware payload (Mirai)", "value": "f98b7cc8072a87e372adc9798a6269d74f9e3972", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927451, "uuid": "86c6f01e-59a7-40fd-afaa-1e6c6050ee82", "comment": "Malware payload (Mirai)", "value": "e37582cd9053b9ec4a77e0002f7c31f5369ddb1997b80132608ab371d6ea4e496943744d5779666cb437f2fa2124e117", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927451, "uuid": "b9f47aa7-b899-4dd5-92ae-d5a36367b1f4", "value": "T13741A9CA5296DF705CFDEB23746A8818758165C194D96F85E4DCB6F171CDD20B040BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927451, "uuid": "62dd5899-a750-4b30-8f60-84961f433048", "value": "48:CD+7t7qxD+X0xD+mkIxD+izxD+fHMxD+2fxD+/MxD++XxD+RGxD+w5xD+7PIxD+t:G+7t7qh+X0h+mvh+izh+/Mh+2fh+/MhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927451, "uuid": "25ca727d-d75d-40e4-a118-d651aa5477eb", "value": 1958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927451, "uuid": "5fefda07-74eb-4d7a-80a6-1877eed84c20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927451, "uuid": "ecd1544d-45a5-4678-b4c6-6f7a055de234", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea049464-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912130, "uuid": "84457633-638c-4108-8c8e-07593ccdf226", "comment": "Malware payload (Mirai)", "value": "6828b285ffb0b4c562a0d66d066f5563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912130, "uuid": "b9e30923-166e-47bd-9356-d6b0876670e4", "comment": "Malware payload (Mirai)", "value": "11186f9e9d9005e8d8f909d127ce85c6efde61bd65345c378d050f983909a672", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912130, "uuid": "e39c7ad2-b2be-4e76-8689-eeceba60f4e6", "comment": "Malware payload (Mirai)", "value": "2123e95533651be0e94b6649505d90de1e0af3eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912130, "uuid": "4df7e027-b71f-42da-9528-bd5bc7c1b587", "comment": "Malware payload (Mirai)", "value": "06c9393e8f6be2b0d74d7febb8a5f117c93f50dac5a38cfde43ff37a94ee4d8ded6b829af0e1ef9bfa1986d6cf00267e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912130, "uuid": "fe54c005-ba7a-40a2-8636-203b5e18dbee", "value": "T194F3E730EA05832BC2D377BAEB5D028D3F351E9777EB37115A3439742BE57A82A29510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912130, "uuid": "84048091-0c70-4ae3-bfed-035d10361ab3", "value": "3072:fywgcFqA5RXHX72MORPiXVNzzXLBYwArfyDujp+SmjlliUmh:lvFKMOZUNzzXLyPKDujp+SmjlliUmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912130, "uuid": "7b51c867-ae9e-4e9b-85e4-2531823de5f5", "value": 165382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912130, "uuid": "4122157b-de42-4c79-ba85-44c00a4bda48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912130, "uuid": "5db50153-6812-40e1-9d4b-1a89e58e7954", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafd3b95-12ef-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743948182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948182, "uuid": "0e1f73e1-dcde-4df7-acec-609de8053921", "comment": "Malware payload (SSHdKit)", "value": "6cf6c1c32486b75b66a9c358905de9d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948182, "uuid": "6cef9769-e2a4-4e46-87cc-28aedc9a77f3", "comment": "Malware payload (SSHdKit)", "value": "113fb44ceb9298e2249b1fa8b873cd04f8e1540f7c593e756adf1bec63f9543b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948182, "uuid": "b46a74f8-cc41-4680-87d8-168425748107", "comment": "Malware payload (SSHdKit)", "value": "5cb8fb9bff6d96ca2445e7585af97a72ab804ab4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948182, "uuid": "c8eac325-c14c-4252-a02d-189c1d6168e3", "comment": "Malware payload (SSHdKit)", "value": "3e4143c9330a9efc501f19a495ca68b9d536154b16d2c9c87d9fd530cc18cd72b3b39df8536cf04cb42c8ce4392b942e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948182, "uuid": "576b9937-c68c-4cb0-beb4-65d3d963150d", "value": "T1E1356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948182, "uuid": "cd6a943f-2ad6-4d67-adbe-f803afe9eea1", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvQ:00BnRED/TwOjX0a5xTdvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743948182, "uuid": "8efa5d5d-9a18-44b0-8ca2-a44e7c98a6bb", "value": 1108959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743948182, "uuid": "fc7d0de0-130e-47ad-bfb3-6b7880cf7298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948182, "uuid": "61cc3333-3dcc-415e-a716-7105f7600b45", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810d7c59-130a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743959628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959628, "uuid": "972764a7-a6c7-48fe-b175-b553d0604660", "comment": "Malware payload", "value": "5006e1fd9bf8308e132593bf22cb010a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959628, "uuid": "2228d24a-069d-4509-abdf-6bea6e353785", "comment": "Malware payload", "value": "13cb2537f08fe1459fe10d1ee00e52eb8decc866c28ed59a1ba2d0b6cef461ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959628, "uuid": "361e006f-97ce-4eee-879d-7c5a1c902435", "comment": "Malware payload", "value": "0375a81d76878f68afb752334e60d57c946b8e4b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959628, "uuid": "56ae8ce5-1318-443f-933e-818658b892d3", "comment": "Malware payload", "value": "d519a4c4eb567379a7c0520fe74bb2f15ededd0d0d1acb466d15b15cd8cf3fe02e0d027934eeb38463e3904ec7565a6c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959628, "uuid": "acf117f1-f4bb-4509-a5ae-837803f73834", "value": "T14803405C4E9E0E0EF41D429EA24245714CB6A9BD7079315BE84FF3B8D4F2609A6422FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959628, "uuid": "9f3377e5-775a-4067-a038-add1ef3005d4", "value": "192:PtHuvH7TiG1SVTrOD53lz6dnVEUIQv/NNt0UoLDu29xMltnl6juakWU3p+YBhBwD:Pt4IwHEv/NNiC2gldliuaPUvBhBdXUow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959628, "uuid": "43e26d08-5065-41ff-b137-6b06d82beac1", "value": 39633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959628, "uuid": "6e897c63-a7a6-455b-895e-b5a68ccc3092", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959628, "uuid": "8ae2d132-13ce-42a3-9ba2-80af6ab1ac77", "value": "uty.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e158ff-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934052, "uuid": "21a8af7e-1564-47fd-8c59-aa5c904b92eb", "comment": "Malware payload", "value": "a05f5bb8946315c77eae9507481b31cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934052, "uuid": "cdeafff4-87d0-4190-a561-a049c58b66ad", "comment": "Malware payload", "value": "157d4120f52152e651ac13005b822d0847ec7f9932b57265f5d1f83363516514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934052, "uuid": "dc8dba04-70de-40cd-829c-c4058b8159cc", "comment": "Malware payload", "value": "934d8392a3a6aa806c97c2def87cc7f6d3c1dc7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934052, "uuid": "c1e1ae15-73cf-4a18-8396-06bd8398d18d", "comment": "Malware payload", "value": "c50485898a835547102d339501e0469584e822766799de62fd262757126a65f780f5a1ffa7e39b8ebd988e1518991ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934052, "uuid": "0b0988b2-3e39-476e-8f5b-a96cf9c12121", "value": "T155A35B4177180557D3E71DF02A3F1BF197FB4E5221A4A246640FB7498AB2E33684AEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934052, "uuid": "03fe04c2-57ee-443e-917c-24e443a18398", "value": "1536:Mxwrzve9HTt8XMLrCrUT9KzLNpQ8Q04SR6J43dQfYDELLCDNAH7dTlnOOrZ:RapTkY9Ko8BmC5ad3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934052, "uuid": "1c8c4c38-4907-43a0-89ba-9b1d3700c5b9", "value": 100344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934052, "uuid": "f05988d0-fb7c-4334-bbc8-623cc86c6a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934052, "uuid": "9ae0529a-1530-4b16-a400-d2c95f3d7087", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2dae0e-12e3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743943084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943084, "uuid": "8fdeab4d-0c75-4df5-933c-2227bcdcbcb1", "comment": "Malware payload (Prometei)", "value": "492391208c22014b5900c22d4a57e910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943084, "uuid": "726f9563-7108-4bc6-94de-6a247b9ab3b5", "comment": "Malware payload (Prometei)", "value": "15945f79afef80b90f3d13b56f8b59c088de2655ffce23dea90bb84f9bae6efe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943084, "uuid": "b2d27a04-7096-4525-a2a8-6b91b454051a", "comment": "Malware payload (Prometei)", "value": "1c94be455866c7d1ad9ed4197e1f72d2548ff149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943084, "uuid": "c2d33fd4-fdf8-4f68-b168-05e0473fad39", "comment": "Malware payload (Prometei)", "value": "45fd5faabd4053eef9061e42bd2fef134639e7cdc63986e3835312ea3cab9b7bb688d6e6b812aeeb21ca8340382f4f39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943084, "uuid": "3fcb529e-30a3-46ed-aa26-3de4fa83a73d", "value": "T186155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943084, "uuid": "d14bbb4c-5d7e-4483-bda1-c9d263ca7586", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplj:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743943084, "uuid": "2040d04e-af53-4f85-91af-bd525b97e8f3", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743943084, "uuid": "8913c828-05dd-4f98-bea1-cda330734e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943084, "uuid": "7d1be122-ce3b-4442-8e8a-06c4174d5095", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170de90c-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917359, "uuid": "bff571c9-cff6-40b0-9f16-2a50d8abbc31", "comment": "Malware payload", "value": "2b4aeacc44e02dd37ba3f4d407aeb6e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917359, "uuid": "6966534c-aaf6-4c1a-888e-c4bb1babec2e", "comment": "Malware payload", "value": "159fb732759a7ca7ed5b90bde8f282b9c5b4b7f52438db4d3ddd5615976ca94f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917359, "uuid": "865d1ed0-3b9d-439b-9ab4-ba063ddb13f9", "comment": "Malware payload", "value": "a9de130a6b55dffcb0ce402a0b450aef4ff8666d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917359, "uuid": "10ecb631-adc4-43e9-8bb0-383f9ba1836b", "comment": "Malware payload", "value": "87a6d10d1012a2d3ff60ab0ecad4ebb09c02fafaca5e4bcb03aca3442506acd00ec9b199ba33a5b3cb755b49e7089309", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917359, "uuid": "bba4df23-8cec-4c46-9c14-9079a95cd1c8", "value": "T13E91113382D6B1DD1CB5CBBECAB83311C80D617CF29EA990A07F235B78E434E1915681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917359, "uuid": "50935f73-0daa-4cd0-9b86-4542eae3b1b5", "value": "96:IiLlhi5q8HC3JW3Y5fo+t/aIr/jo9xcYGK5K6qTZ3v+9IcWTpsuv:IMnJRfRU9rGKjQycpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917359, "uuid": "fdc63bd8-0470-4696-ba81-5fa358c0f3f5", "value": 4533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917359, "uuid": "1cca303a-106d-4b56-82be-b31d9a8f2fbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917359, "uuid": "e3376b9e-0c36-4b92-87ba-2648437019ff", "value": "terms-use.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d51181-12f1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743948763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948763, "uuid": "74251e33-9332-4806-be62-ae48a3604a28", "comment": "Malware payload (Prometei)", "value": "80add79d81c089ab6da64a1219778071", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948763, "uuid": "95060a91-02a9-4802-a2ee-bae5592fa8f6", "comment": "Malware payload (Prometei)", "value": "15cda6d2bb63afcb6457bd8b150a5204f4745a1ef15fc22648baa0ebe8162b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948763, "uuid": "4822c6df-0d3d-431a-bb2b-f0a37ccc0b08", "comment": "Malware payload (Prometei)", "value": "2e77c0fdbc48aa5b2d5cd50fe11ea53465576545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948763, "uuid": "a7fc73d8-4011-4bec-8a70-36f3ee8a9d01", "comment": "Malware payload (Prometei)", "value": "8891c434b9991a0f3342dc8a407608f239b3609ad832824f19e25a598220f693a289ad6d7a51e354d4b19af50cde09cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948763, "uuid": "4182afbb-1ad8-4432-8821-447ee24fa04f", "value": "T1E39423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948763, "uuid": "dc7bfcdc-5e63-41ad-a334-f9ffa81f2434", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743948763, "uuid": "650eab3c-7906-4609-87dd-55256cf69984", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743948763, "uuid": "74e18160-59e8-4282-9e3e-a5725b2106a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948763, "uuid": "fefea244-fed4-4993-a026-b422f0b8bf04", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a068a13-1326-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743971562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971562, "uuid": "ddca4df5-80b3-4f6f-9c1f-6675862b8220", "comment": "Malware payload (Prometei)", "value": "4abc485a976a5d6a555a2bd55c709c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971562, "uuid": "5e9ebc2d-4fe2-404b-b026-7a688ec5f1e7", "comment": "Malware payload (Prometei)", "value": "16203a894c3d88f41635753f810693b92fbf2e1273891720b740fb77b97073f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971562, "uuid": "e10ef7d5-7ffc-48eb-83af-ed9ebb2a46fa", "comment": "Malware payload (Prometei)", "value": "69f0f382f1eae5e44ad9da55a4b75d1738f4f764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743971562, "uuid": "a97a9d80-d950-4b29-a074-8f511637388e", "comment": "Malware payload (Prometei)", "value": "d3fc324cd5bc7d77d5edf3d7b56cc54db072c4ac2e965b052320b406863b818cb5d216dc749b8aaa079bb1ace1109273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971562, "uuid": "24334e42-47a7-46ef-8b87-d7180bbf14a2", "value": "T1B99423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971562, "uuid": "9e002796-1b25-4040-9535-b73f10c78b77", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743971562, "uuid": "4bd0a7c6-c3d7-47c4-bc34-fc0cbe4b8640", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743971562, "uuid": "553bcfbc-10e8-432e-a50d-127caeb0f6d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743971562, "uuid": "5c078ea4-69ce-4240-8179-b06a24cd7534", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3760af1-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743934050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934050, "uuid": "46bee1a4-6c07-41b8-b618-b7c500fae613", "comment": "Malware payload (Mirai)", "value": "f5a25f1fd8377181a5176e7ad598b6ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934050, "uuid": "626c0640-bb01-40d4-ad8c-f030462378a0", "comment": "Malware payload (Mirai)", "value": "16259f4e83b881b7dcfe55a760fcb9dcb708f3fcd801a3fb6436bb7065b45cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934050, "uuid": "c7470259-973e-43ab-86df-68cb2e6a55b5", "comment": "Malware payload (Mirai)", "value": "9710e63db54f62d81384909df8bc7b7aca87923d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934050, "uuid": "d6fe9cd8-9327-4841-8090-0b7f37239ff5", "comment": "Malware payload (Mirai)", "value": "7bf74ac4ff2077aa615cfff57de8cb4d57f4b465703d30e57a1ba9adc795282f33a222c73a502984aa65b050f0fdf6e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934050, "uuid": "9d67aa5c-d77e-41c0-beca-0751487b56ac", "value": "T1FCB35BA82D0E7DE2C3CBD37EDF088961312B7164C95153E2BE11A3CDD2DA9AAD9E4450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934050, "uuid": "1f5c8232-4eb3-49e1-b15d-895bea3af370", "value": "1536:zoIV54teTV1scyHEZU0hU/SmD7yKdEvsxDdnogTtkNksGtyzHmf:sIsteT7tyBV7yKdEvkR1taot1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934050, "uuid": "a14af885-8eaf-4a80-9f91-bc2ab6ad5a52", "value": 108416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934050, "uuid": "4b0bbfe3-bb4f-426f-813b-f35eb8675842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934050, "uuid": "4c2c97a0-ae08-4528-9397-84cd876770d1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8f120b-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743938500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938500, "uuid": "113e6e1d-5c93-4dba-be67-a490ee9c0c6a", "comment": "Malware payload (Amadey)", "value": "5a0c7d37859d3542f6772b9ef5ee5cf8", "object_relation": "md5", "Tag": [ { "name": "092155", "colour": "#F7AA6F", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938500, "uuid": "2d725bb0-7cc5-4f7c-8388-15414b061cda", "comment": "Malware payload (Amadey)", "value": "16b64046640bb6230c3bf41bdebb18224781fef9f2225bc30b82a063b1ed3fa8", "object_relation": "sha256", "Tag": [ { "name": "092155", "colour": "#F7AA6F", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938500, "uuid": "b553566e-76b2-4bd5-9d95-ee6f7605803d", "comment": "Malware payload (Amadey)", "value": "27b53f77c9f99b87c6f9b1908310a5e2d73d1a79", "object_relation": "sha1", "Tag": [ { "name": "092155", "colour": "#F7AA6F", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938500, "uuid": "6d4ec2d0-749d-4244-9064-186fbd493892", "comment": "Malware payload (Amadey)", "value": "fe42f5daef1ac4f493040f4f74864e6ee8b68dcc0c55f797cd9685891e26164bb3717c2dac6e4947530badf25c3816c0", "object_relation": "sha3-384", "Tag": [ { "name": "092155", "colour": "#F7AA6F", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938500, "uuid": "6c2b8279-2acc-4d66-a637-365f287041f7", "value": "T10956330386598416E2AE4B361CFB53D32874FDAD5EA087D26143E85FE6A43702361BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938500, "uuid": "c6e35e41-4f55-4102-873c-a96b0cbca0f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938500, "uuid": "87491d1e-754b-4dfb-bfdc-14d6efec02ff", "value": "98304:zN9nbWR9YW1UZPiPQHMP6sYv15XNcDNwKmzyVyrooaCs3TOJ1yC/nCjlHI8GpHCz:HY9YO+PiPpY3NONweCZ/ycPBCvJ9F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938500, "uuid": "09c74b56-3b2d-4fe4-88d6-085edbd0936c", "value": 6416896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938500, "uuid": "1da98714-4607-4f17-8752-77053e39d85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938500, "uuid": "0e816e43-0646-4c0d-aa19-5281f4d663a8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38294829-1280-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743900235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900235, "uuid": "54548e1d-e01e-4ee5-8f0f-0afd4ec6ec48", "comment": "Malware payload", "value": "72a8385a697ad2f0a921bea27e06f57d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900235, "uuid": "1c9dbd3b-1321-407c-bd0c-6aa5bc27917e", "comment": "Malware payload", "value": "179efaeb10e7256240b0f454f75fe4ab5326165acb0ca0d55ff20a066c5aba8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900235, "uuid": "ab4c2468-a424-4fa3-bcb7-28fcbe9e1eae", "comment": "Malware payload", "value": "12f07db439f2589afdf5b2f5c0d9ac70349025bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900235, "uuid": "34715f6f-f182-44e6-aed1-0742f1bebe22", "comment": "Malware payload", "value": "d6aa67b389e79807c41e283ca77b373142a4c232d65b283a4bb9377c2d366b889c4e1e05920285ae58278e3ff05f520b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900235, "uuid": "3a3ae3b2-1dd6-48ab-84bf-64fd17685e3a", "value": "T1B726332336E957F5C1644073AE945BCA7AFAD6411E1547B32310ABFF78F8C20910AB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900235, "uuid": "e7bf65c2-3b31-4f22-975c-2565e5d5b379", "value": "256c6be6d56ee2b4ff99733328ada0d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900235, "uuid": "2d3d87ca-6c26-4bc3-92e0-b02057c659fe", "value": "98304:xTS9ilTfIuKHKPeDzhJkQbGvdXj6ADuIKVPvt9ePVOjE:xW9iiuxPefXkQSvsmuHpasjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900235, "uuid": "a856a4a9-3eaf-4d80-b179-ce095f2fce82", "value": 4560488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900235, "uuid": "d7cd52b9-b8de-418a-81cf-fc985f026f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900235, "uuid": "717c9187-a3db-4b77-b43a-e74772744a46", "value": "slimcomputer-1-3-en-win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449afaf8-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1743918295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918295, "uuid": "afb23e80-96cb-4c47-97a0-c394ea614fd0", "comment": "Malware payload (GCleaner)", "value": "1ab955745248928420662af3497f0c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918295, "uuid": "10729992-8559-48c8-acb6-1d4ffcdef335", "comment": "Malware payload (GCleaner)", "value": "17eb4a729732363329240c1c8a79f22b939aa4b9fe59c52c4427867938118b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918295, "uuid": "392b577f-fb15-4f15-a60e-cc6318e04627", "comment": "Malware payload (GCleaner)", "value": "71b61f9176a1d61ef01aae78d30ef4c865fc8fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918295, "uuid": "7bf60285-9416-43dd-98e5-eb95d4c07323", "comment": "Malware payload (GCleaner)", "value": "822263a8895b386ba294574cc154ab4483d62d515996e6a2fb522a41023c9f62a860f60808c0d7e9cd9d12ca30003d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918295, "uuid": "3814fed0-9a16-41e7-8305-84b8cf4790da", "value": "T12126337D3066A17AE6BED6F03E830B73A0CDE313C577941EB604FB587A3558C89190A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918295, "uuid": "99a1c821-09d7-4c6b-86b9-0f67d09d94af", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918295, "uuid": "59c24d1b-165a-4769-9c2d-d8c5af880ba4", "value": "98304:ZLtGtuNyfVlaCYqP85+zoIhcZZHDN4zz88xgQR4nWH2RyX43swn:ZLUtuNy27y85KeZZHwzwQRP2E43s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918295, "uuid": "58498e84-1d60-4d88-85b6-d9c847707c9f", "value": 4530176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918295, "uuid": "b6df4c48-a158-4dd6-8c40-91a40f931366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918295, "uuid": "3946a1bc-343f-4f84-8e2b-869a695340af", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991e20c3-12f2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743949360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949360, "uuid": "55ee9011-b909-4646-ab26-8f5f3b0891b0", "comment": "Malware payload (Prometei)", "value": "9b40894e63b8b054c3b83b7f2ffefb37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949360, "uuid": "3663a9d9-d485-4842-a2ab-b0fdd4beb84d", "comment": "Malware payload (Prometei)", "value": "1917bf7ae63f91b25e4d6781d3297c328465d7778da081c6883a77507fbabcbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949360, "uuid": "cc6f8903-e32c-4c19-8676-f7feca2ebe1a", "comment": "Malware payload (Prometei)", "value": "e9eaef90229ec45ef69ff7cef6b0db44e709f750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949360, "uuid": "17aca2ba-5ec4-4d5e-bf17-701fc11d53f3", "comment": "Malware payload (Prometei)", "value": "c06e11ac3cd47ea587f9239cb10760ea580bbcb1eabd676213ccd3c42b8eb0bcf4a17f06fa47ad90551f0f4a77213dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949360, "uuid": "4260dd55-f197-4a99-8c07-ba92f42f84da", "value": "T1B79423F8C87D2E3098169B3CBB1A8268F0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949360, "uuid": "1223be2b-1531-484b-a369-2bf3355c0795", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgm:25WOSACZSV6eKRH5EPiamb4DsDwwc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743949360, "uuid": "afe97f2a-b134-440b-bf0d-0717aee5aa35", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743949360, "uuid": "28756b63-b358-40db-8e92-6519736ceda0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949360, "uuid": "eb00eb73-2697-4da4-8fae-cec2be630465", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b64d69-1280-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1743900416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900416, "uuid": "f576dd6d-d4ab-4701-8c0d-754f93dd4b8c", "comment": "Malware payload (Gafgyt)", "value": "6598882c252876b573b446ee80b8869b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900416, "uuid": "8c33b130-f0f0-4017-9b60-1a0bf97cee68", "comment": "Malware payload (Gafgyt)", "value": "197422b9caeffd55a68a37af34a2503210eb48fb17e660ef86f082a2c52aad73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900416, "uuid": "3c4aabb2-699b-40d2-9c4d-bae7223bf1ab", "comment": "Malware payload (Gafgyt)", "value": "a0bf04123858a419069f599060de9e8d7be6b135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900416, "uuid": "f01e073c-4c21-4c8b-bc1b-92e8f2a42033", "comment": "Malware payload (Gafgyt)", "value": "6cfd01f2843cd015ea0182616c937201449171c0a679b92c20d69dbfa419373c9ddc5b949415a116b68de05f106efa0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900416, "uuid": "cc81d60c-fc41-4b88-9121-fc509c88b70d", "value": "T140048486BF603EFFC85ECC3351A5CA0A119C99591298BFB75A34E414F78B10A99D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900416, "uuid": "d5de9313-23ac-4bcb-a456-c30d2b9ed5af", "value": "1536:idMU5qfvXVk293ZB8bcZj8OkRWVbDrTgBtG4M4uoEcElvwdTlnOUr:idMYqfP+RHODWBtGendR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900416, "uuid": "a443aced-f3ef-42b5-ba55-5a8726749fcf", "value": 186684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900416, "uuid": "1753583b-ca42-445c-be71-d5d5bf34bff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900416, "uuid": "0dc4c943-cf3a-4103-9b1f-ae37f412f625", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eead0e-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917972, "uuid": "5c411ec8-7d93-4237-a127-507486346f35", "comment": "Malware payload", "value": "3b2f1bb9d799fa1015db6a91f39c4d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917972, "uuid": "ee2af9d1-9dbf-431e-a20d-6aeabdaed93b", "comment": "Malware payload", "value": "1978855f7f432ec011593550f168353e21afb1b2815271912e5005bf1eecca32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917972, "uuid": "df32d082-e638-4369-b728-55e49cd37d86", "comment": "Malware payload", "value": "50ec3bd32b426e9a2999dd71d7113bfe4db22f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917972, "uuid": "0d0d376c-f34d-4b4a-b8ae-da4423c3eaf5", "comment": "Malware payload", "value": "1f93f9113e932ddb119b4443dc6220ecd149cce0605d41d62aa8e67577184e817d8b70164f6c25d8a6691c37289bad4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917972, "uuid": "338b1b13-a825-4c6b-8ad5-09b7077a71e4", "value": "T1B4163340B3C728F2C9A1D9B1BE5CD72613B6DA6957415E4393E96C292EE30B00B4B1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917972, "uuid": "c2deeb96-8285-429d-9a38-c734919af23a", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917972, "uuid": "eb3f6d61-5470-4f72-aa6c-3391c51adf08", "value": "98304:+p413kko9DUTkEywOQPr/uvIfH3vy8iYqLlaSZihAX:+p4t5iSOU0uiYrSZihAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917972, "uuid": "3be63ff8-fdc8-4edb-badb-a0ea48aee967", "value": 4115091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917972, "uuid": "e7cc5404-0fe5-425c-b7b4-bc8eecf9f96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917972, "uuid": "edb290eb-f49b-4775-a3d6-5101f71223ac", "value": "ATLEQQXO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0479dc8f-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918187, "uuid": "58bddd40-b866-4504-be6b-216f7ccdc25b", "comment": "Malware payload (Amadey)", "value": "f8e26aa8d0e36e4715bb611c8ee4325e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918187, "uuid": "e4c0260d-99f3-4dad-b196-a5ec303d07fc", "comment": "Malware payload (Amadey)", "value": "1af10179025d8901d6a774a0faa3a817095032a8d3a94c897fb78f57a896a129", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918187, "uuid": "414c40bc-d094-4148-ac64-d5ccd01efe00", "comment": "Malware payload (Amadey)", "value": "7b44a79eda592b45e12cf53209f257762b43f003", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918187, "uuid": "0e9a286e-5eed-411e-b9f2-47ad14a699cb", "comment": "Malware payload (Amadey)", "value": "2c0d900479a4f4e0cb915b50f08c016202165c9594de89ae3adb2421fb5e719defea8d0c1ed43cc505666f5005197588", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918187, "uuid": "4a2d9334-5b34-4e8b-ab5e-c8c926e09bf6", "value": "T11166330A537CEA22DC6123701EE886C72E367C131A6C46433B1F9A995CB27615D673EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918187, "uuid": "942b6304-2277-4f00-86a2-9523544af213", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918187, "uuid": "e182be6f-6886-4328-82f0-3dcb289a5d10", "value": "196608:4o9yNMMKE709CYUneSOv/g8NsIIyYyfeDhk/vA:X9i7n0TUneTgAGRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918187, "uuid": "4539389c-13d1-4334-ade4-befbc578e6f1", "value": 6475776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918187, "uuid": "12d0cccb-deda-472e-a2fe-2a73df10a114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918187, "uuid": "c2d71bbf-e11d-4b49-b2a4-4c0913055a81", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f48db7-12f7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Emmenhtal)", "timestamp": 1743951524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951524, "uuid": "ab6bc745-6f2b-4dc8-bd74-f8523b31c3fa", "comment": "Malware payload (Emmenhtal)", "value": "26f1ab1f9a10e8423edb4d882ec6b0f0", "object_relation": "md5", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951524, "uuid": "ecb4666a-49a0-41aa-a123-8fbe37993309", "comment": "Malware payload (Emmenhtal)", "value": "1b6b6661ee8b617e43afa86b60ed7486f6d0e47a8dae272678d84fb15f5d9cf1", "object_relation": "sha256", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951524, "uuid": "0241b395-c11f-45af-8dc6-b31f0020a8a2", "comment": "Malware payload (Emmenhtal)", "value": "08e00b13c9b600d69da95626562721bd35f4d6ba", "object_relation": "sha1", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951524, "uuid": "c3e62690-5122-4700-ab88-dc06a36a097e", "comment": "Malware payload (Emmenhtal)", "value": "3437c25b29fc6e2bff18da81c3139ae695bad55995591bb300a65aa548105987cbd93287036c8c7d5f247542d7f7e261", "object_relation": "sha3-384", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951524, "uuid": "d6d321e9-598d-47ff-b3a6-f9d480fa2d8c", "value": "T1BE658D12FB809879F37213340D16B6A9416E95388F1089DFEF515AEE5D62BCA1B3C60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951524, "uuid": "e2ca6399-d992-4c37-8d5f-8c5aea7db116", "value": "1f5b4307b67ae3b1cba7ca7438b42bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951524, "uuid": "3c7d1b17-e7a1-4216-891c-93f9e3ef2a33", "value": "24576:pj44BUm0MoCly4Ry0WsqQvLmj44BUm0MoCly4Ry0WsqQvLqj44BUm0MoCly4Ry0D:HUMyB0WsqQzwUMyB0WsqQzkUMyB0Wsq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743951524, "uuid": "46cfbfe8-8428-4e01-a292-35954a140af6", "value": 1439085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743951524, "uuid": "c6b19b5a-0057-4efb-aed4-4c455a03b5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951524, "uuid": "4938087b-3a6e-4436-905b-32c22f06f49a", "value": "SecuriteInfo.com.Win32.Malware-gen.24218.5154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a31c48f-12f0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743948476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948476, "uuid": "22f2a625-1e0e-4a46-8d78-02a084633004", "comment": "Malware payload (Prometei)", "value": "895034805ad4d6eb1ce7d659e1b99135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948476, "uuid": "eb946d77-e1cc-4c09-b2e9-5d06ed9cf2a0", "comment": "Malware payload (Prometei)", "value": "1b77a0cf51c0fa39d3e46eb6e43bd7b65b5186c0810fa82af8c1339120a9736e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948476, "uuid": "f74f7be2-a028-455a-b565-c69da4a59886", "comment": "Malware payload (Prometei)", "value": "2a64d9b7c49a38298ceecdca0ab36ad0a0f024eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948476, "uuid": "a7318b19-83c3-4312-9829-10da106bd7eb", "comment": "Malware payload (Prometei)", "value": "897f895f5a07c788cd8bd04a794a7bae38fa93939b159764b62416b16c12bfc96adcba5b327324d0611eec97bc262923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948476, "uuid": "de06419b-8ec0-444d-8a50-532aae1a2dd8", "value": "T11C9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948476, "uuid": "14486abf-ebea-4fff-b479-265fc1fb071f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg+:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743948476, "uuid": "0e306bca-8915-4043-afd4-cb8cdfa25bcf", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743948476, "uuid": "b0effbbb-37f5-423e-81e2-4b22afffcad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948476, "uuid": "66b66cfc-de89-49eb-899d-3772067074d4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cfe6f5-12d7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743937676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937676, "uuid": "bc97ed8a-7646-434a-9462-a9e6efc859c2", "comment": "Malware payload (Prometei)", "value": "d2825267111c5525ee20be68443ae046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937676, "uuid": "c961be5e-3a4a-4acf-8932-ab5d5b2f05ae", "comment": "Malware payload (Prometei)", "value": "1b9cdfba72480ab8b5bbc2c182abb4cb6d232f58839577da04ffcfd678154d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937676, "uuid": "900f4da8-846f-4e10-8d10-c86a12198096", "comment": "Malware payload (Prometei)", "value": "6d447d970445f3b8b898584c41d06ab3e3ee1aea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937676, "uuid": "dd269cde-10b1-420e-9f12-8b6be95021c2", "comment": "Malware payload (Prometei)", "value": "8e312e0454a09a02d900005b80bd06059f613a7a08184233eea7be43dbbc1872e5d11bd60a49f0c04e1618739639e46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937676, "uuid": "8dd9d05c-168b-475c-a4d2-168cf3d5b01d", "value": "T1C19423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937676, "uuid": "003ea65b-ae8e-418d-96c8-238495808e4f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743937676, "uuid": "865de671-4e67-4d06-b500-58faed41f73f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743937676, "uuid": "f22ec0ab-b922-4600-addf-d5ad7415a2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937676, "uuid": "ed4876c1-9ac2-4d13-811e-49fd5db97db5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21daf4e2-1339-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743979655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979655, "uuid": "577fc859-04a4-42c4-8b7a-7b59c3b640c5", "comment": "Malware payload (Prometei)", "value": "1819447f61391ddcb5bd32f11bab1b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979655, "uuid": "d246f4ba-d92c-4295-ae3f-146d9d69392e", "comment": "Malware payload (Prometei)", "value": "1bc3a358d7d90952bedd172f5f94be841b5e3a500ad2660381f0c179a4c13867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979655, "uuid": "d73ec960-09ba-4a55-927d-7e86169372d1", "comment": "Malware payload (Prometei)", "value": "a275b3383101b7c05288907843c5f6e50bda6b6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979655, "uuid": "1b361745-34f5-4974-a55b-2b44e3b47615", "comment": "Malware payload (Prometei)", "value": "52f22f1d98c6702e392eac104c5d21ee57a1e4511f6639388ca5b1c1f21d74262f8f24bfa011a710e30142ff155dad18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979655, "uuid": "099cbdf2-4f45-4b01-9111-a4c32faad143", "value": "T1DD9423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979655, "uuid": "5ff55b48-fe8a-48cd-91b3-00d5bac18c9c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgN:25WOSACZSV6eKRH5EPiamb4DsDwwc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743979655, "uuid": "00b9a22e-25c0-4ede-aac2-03fbf34e5e26", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743979655, "uuid": "276085b0-1977-4561-943d-ad7a161ace08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979655, "uuid": "01d7697b-ed86-4907-9f40-2d940e90d4b8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774d34f-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918139, "uuid": "4e84c4c6-3063-44d5-b7f7-7e7c6e12611b", "comment": "Malware payload (LummaStealer)", "value": "0a521ee2aa3a40141b8f16afd83d3ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918139, "uuid": "905f78a5-ff9c-4d40-ba29-e5030333f9ab", "comment": "Malware payload (LummaStealer)", "value": "1bcf3e316f717ce95a525401e0fe581248bf18c5e104b298e180dcab1d77d2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918139, "uuid": "b95929d2-9238-4cc8-aa43-b733eb6b3fea", "comment": "Malware payload (LummaStealer)", "value": "c5f6a52316570d67c0af738eaf690e84cc6785dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918139, "uuid": "5f703f3b-9181-4a52-b3e0-0a0ebd2410cc", "comment": "Malware payload (LummaStealer)", "value": "0be693dad819956744a6b8739ce4567f2a5d2241200b82d358b10bb8152c91fdba20b5f6f6f9bf3f1cde4b3a370ce0b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918139, "uuid": "4ad15025-23b3-4e57-b50f-83dd41e0d3c2", "value": "T1AFA522669EB3B467CA5BE8F0E123D8B694ACDD545460DF17819BD20CF878BA0C225F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918139, "uuid": "223359fa-250e-454f-b3a4-5dd7e2e8906a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918139, "uuid": "faf608a1-0162-4c55-9375-2e5cb2d5fc3f", "value": "49152:6AqOuLnzgEhWK/qknNqrSHJ+2QVj1YfBA5skUt3NljlV:6AqlzkEwkNqrNuM9Ut35V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918139, "uuid": "a8106d44-bbee-4dd7-b1d0-3e5a9c951695", "value": 2096640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918139, "uuid": "2faac3aa-9cee-4f62-97f0-f7e38b38e492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918139, "uuid": "65dc4301-d676-473f-b7f8-af95dd3fb878", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592689e-1335-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743977970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977970, "uuid": "a7acf702-a502-49b1-bd5d-6ad4e7719a5d", "comment": "Malware payload", "value": "69b9ed7362b8c92f13ff6849412a4870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977970, "uuid": "eedc3493-86cc-4b58-b032-e64b624c96bf", "comment": "Malware payload", "value": "1c6edd79b90445702d7996081adbd5ae0bf804d839c535d28b5e609f10f81052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977970, "uuid": "1d111856-0f50-4c8c-97f0-699ffc5b6052", "comment": "Malware payload", "value": "f9d5ccbae993c90275658770284181d89e162156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977970, "uuid": "daf2618a-8e55-4ef0-94a5-3d3692865cfa", "comment": "Malware payload", "value": "927136b89d6bdc139684fefca4c27e41636126b24d8ed145bb26b8b7f53e73a4757370ab62ec79adc1e59b050042dd91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977970, "uuid": "868f01bb-db8f-46f4-9f26-fc1845ddfc18", "value": "T188646C2EB36814E5E97BE17DC986850AE7B178660313D2DB11A0417A3F17EF86E3D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977970, "uuid": "25f352f9-db39-4509-bfff-56623817e77f", "value": "1d912fba09e7394bdabb7bc6b6a6cda1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977970, "uuid": "49893713-53de-486c-a2e8-5e7f7d16f229", "value": "3072:sfd7wFlp/fsceM/BEhktpgB8q7RceJ198MhSZwLgMfG33tX9KkSE6PQ05zVhfrtE:sby35uhfBiMgjnBd/084kMLfHFQZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743977970, "uuid": "72e590f8-33bc-4ee6-9d3f-3fb426a61215", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743977970, "uuid": "d4a3d45f-1f08-4814-8469-7a6445498f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977970, "uuid": "da344ae3-3fab-4da8-9f7f-03b22ff2e73f", "value": "AggregatorHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad81d7b-129c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912427, "uuid": "d803d72f-aab2-4ba7-b8ed-a134c41d5de4", "comment": "Malware payload (Mirai)", "value": "ad8c0519a6e35cfb8c0a2a8638abe0b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912427, "uuid": "f72993fd-66a1-4ef7-a071-83d8bfc1909b", "comment": "Malware payload (Mirai)", "value": "1de762ba5e266291c62d7b578bc04fef99ac6e0f84c20a4b4d95fcd74967a402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912427, "uuid": "157b3bdf-72b5-4a12-ab6d-649ac1e8e1fd", "comment": "Malware payload (Mirai)", "value": "0c3be608cef567779a7b7c6bbabcf60ab2fac962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912427, "uuid": "3dab5723-b6bc-4a37-afdf-a35d5d58471a", "comment": "Malware payload (Mirai)", "value": "c607b3002c8a193bc10c0ece86002a1d4930c2f6f6f667a24201faf4ae4e039b15ddc810710e303f3e65a018850568d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912427, "uuid": "aa96545c-b447-4421-bb3e-e2737b4fdeff", "value": "T12E2302784B0B0E91E9C92B74FC05CBC0F763C6877BA0E91683991691E015967EBD85FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912427, "uuid": "4b761298-9b0b-425a-a485-ca00131e4e14", "value": "768:Xfs5o+vBTJ/Z1FvxJvxEmjnKSM4YlaETV4jszFmgUuPeIkZkhnWV6ljs5SYHUhGk:k/BTJ/Z1F3bnKSM4YcETV4jsveIThnWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912427, "uuid": "745b66f6-2305-4dad-be98-a231a5fa15a1", "value": 46688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912427, "uuid": "37356837-0fc1-450b-a1d8-e9c00dc077df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912427, "uuid": "bbc77f91-0370-4d47-b754-ecd217fe60e4", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a398388d-1309-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743959256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959256, "uuid": "ba36243f-96b4-4258-a190-09fc1b2eca31", "comment": "Malware payload (Prometei)", "value": "4e62da572d8d534830dd2e38ca383e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959256, "uuid": "c0fb6bd4-d055-4522-87fd-048e4facb4bd", "comment": "Malware payload (Prometei)", "value": "1f156e8d364eeb36eafa213669c508d72ccb516f96852dcd61102f2a65d8cc05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959256, "uuid": "21b7128b-ea89-419c-b2e6-ab28c92429bd", "comment": "Malware payload (Prometei)", "value": "daadc0a3d4c124000410d117094394859691c349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959256, "uuid": "8f7a805a-564e-49b7-a681-561932304f49", "comment": "Malware payload (Prometei)", "value": "c13c56eb87d7f594d783705803c6a9a453138d093dca9429f16f8edac0892de47872947c60cfc09976faca761cdbb980", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959256, "uuid": "e3df3faa-cb42-426f-8796-022ff2a547f1", "value": "T159155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959256, "uuid": "168ff7c5-1623-4f62-9141-8f6816cfec4a", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl8:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959256, "uuid": "74b5144f-3e18-4844-bb7d-f4b517563c0b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959256, "uuid": "157cec74-259c-4a73-9453-52900c0aff85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959256, "uuid": "b83f1e90-2eac-4ae8-954b-ac1caa8a9cb6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6953083b-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918356, "uuid": "98932e25-6f73-4e8f-becd-ad9861559ccb", "comment": "Malware payload", "value": "633a075bec8fccf8a55162c34cbdb6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918356, "uuid": "fd8298f0-e1d5-4843-943c-b14d88e55c00", "comment": "Malware payload", "value": "1f85d1ebc8c01f6e0585d612fe5cb8b6993a6b9dc3ec98d54a320a91ad8cacfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918356, "uuid": "7dbc3c65-0070-4be4-af6c-b8501da10493", "comment": "Malware payload", "value": "8d1e5949e36a7ba827e2fb1e3ac8027069944657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918356, "uuid": "506950fa-42c7-4345-9117-5f560a2a78de", "comment": "Malware payload", "value": "da60bac4551b556ec119c2d19347508049ff62757ebfd2640e2d3b318182fec31f608359381983364ebcafabb1f547b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918356, "uuid": "78a4ef21-a385-42ff-a3a0-e2ee38160c84", "value": "T1C8C5339FFEA62876D2D9F6F903A79D623F843650438961941713A13E330A89FE776C04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918356, "uuid": "558a30ee-c27c-4d3b-a6f4-563b0691d70a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918356, "uuid": "c8cf97a2-9bbb-4290-9b8b-40c143be392a", "value": "49152:sOKKdjJKiVB53RIe99mmQQMILJ5liK+SCjMXpr7aIjlP:sgJpBhR799mm9xZ/CjQV7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918356, "uuid": "f05293df-63be-4381-b0a9-293c958f0673", "value": 2508800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918356, "uuid": "a7927f6e-00fb-4fbc-9b15-b0cee9360127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918356, "uuid": "8e37e19e-ceb6-4b22-a793-16b3c63f57de", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662299ae-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918351, "uuid": "1a0c4f96-0aee-4ecc-9798-0148b02cd3cc", "comment": "Malware payload (LummaStealer)", "value": "e092a62f89aabd8b376cd2e9483b592d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918351, "uuid": "4cd44e35-1230-44aa-aa59-280c6f7522a3", "comment": "Malware payload (LummaStealer)", "value": "1ffe418df0d19f844b02862efc65aa7a58e899da2278789db0ca47a61e7d6f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918351, "uuid": "fb276347-ba2c-45c0-9ba2-99a3b29daaa1", "comment": "Malware payload (LummaStealer)", "value": "5d52291119869429648dbf66596bdf414919932f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918351, "uuid": "da9e1222-8414-4f32-9657-1ce95591c7ea", "comment": "Malware payload (LummaStealer)", "value": "470bf93797d1dd058851fd6977b410bf808d0b7dfb4c12a90e162c243cd07fa699113a633e531f896fd530ebf98205ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918351, "uuid": "af54597a-04ca-483f-a2f5-be8040b9a2e0", "value": "T1B8A52386191086F1FE957F711BCB0AF825658BF33526D59142323F9A03BE918F7278CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918351, "uuid": "a8f4fa94-387a-4da1-a66f-1b56f2995594", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918351, "uuid": "6ce280ad-d468-4f26-ae26-fd4ade18f191", "value": "24576:E0cBrcnbqMuKS4YO5p8CG9+ss9TgVyBNeRfIE0FW5SoBvX7IoMW0cT3bAu/6KLrg:LblmOzxY5AtdoZ0TW0crbdy6kv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918351, "uuid": "9c872790-5342-4ca0-8dcb-63386dbf0113", "value": 2119680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918351, "uuid": "6c4f578a-8817-485f-93a4-a9736fb1c3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918351, "uuid": "4f544519-1ad3-42da-a55f-ab4cf5872961", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0d2b3e-12a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743914227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914227, "uuid": "70e5f983-4012-4263-8a67-18be3ae5f068", "comment": "Malware payload (Prometei)", "value": "cea81e9a744077076a90531fb428559b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914227, "uuid": "85fe53bf-e27b-4ba9-8e7c-cfc17242f787", "comment": "Malware payload (Prometei)", "value": "204351037bc5fac1b9234bec5d22eab239cc9b38aa2206aae033686c28f20e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914227, "uuid": "a4f6a51f-a598-4f40-af85-769fb6d06949", "comment": "Malware payload (Prometei)", "value": "afdd5b67c95b30c11196bb8edb1373ae438ff55e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914227, "uuid": "ab4f1141-ee2e-4ae3-9361-c0a7b63d5238", "comment": "Malware payload (Prometei)", "value": "594a50fd1c0a29ebb28c46d80d8382fa3dc02de6c349f0c7adad01ab031162ca778b9a6736b7270a2f588a375fcf04d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914227, "uuid": "aa0427be-575d-4b5d-aa5c-45519ec25f59", "value": "T1EA9423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914227, "uuid": "69440359-984d-4ba1-a093-2f19c2369de5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgy:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743914227, "uuid": "c4ecb74b-405b-4c67-8077-ef3e46f8ea64", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743914227, "uuid": "8a65e6dc-10a3-4688-bf55-e027b4a0498d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914227, "uuid": "de8b8b28-b031-4ac5-9991-89284f0fe29f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3b4ee8-12e1-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743942141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942141, "uuid": "1a473772-c9da-41ce-9e0a-a66128381b0c", "comment": "Malware payload (LummaStealer)", "value": "fdc27fded8994e956f39b56d792af116", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942141, "uuid": "0bc9b5ef-33f4-4e86-9636-7a9fae0f9356", "comment": "Malware payload (LummaStealer)", "value": "20714594e6b79fffe78150560ccb68a5d21a21f58595b47652a6fa0117696c14", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942141, "uuid": "8c61bc2f-2bc3-489b-bdf2-79a2d6d2f5c7", "comment": "Malware payload (LummaStealer)", "value": "befdd1dc724f4829e049b8b6069119073fae74d9", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942141, "uuid": "59a14393-09a4-476d-916a-aab382d209c4", "comment": "Malware payload (LummaStealer)", "value": "6e8804d160a7b1c8546e5755222dbc4df2ee4a2d0959923ab0625fcb93bf0860b5eb91c8dd2cd3118dfb98bc61db2294", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942141, "uuid": "33e12450-4b6e-43b2-8295-94c9bbf9084a", "value": "T10B9712E25744377B9C1BB8233F0B612D607B85B2F0A7336B265FF600913A615679A63C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942141, "uuid": "7a1ce235-d536-47bc-b605-6ef3c3fa6205", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942141, "uuid": "f036174d-5e02-43f7-aca0-5e42344a6b52", "value": "24576:O0acSjyYg2gtD2qZUAh3hJ4QkkrB7VKIvnYDO1bl66:Oi/YgpDCwxaE7HnY45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743942141, "uuid": "f70f182b-82d0-4802-9f62-fa45035b7e66", "value": 43004735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743942141, "uuid": "d86e19fb-4e5b-4749-b059-7f3c82b35755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942141, "uuid": "a10eb332-ab7f-4e84-8d09-035c37477f02", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ece280-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743924444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924444, "uuid": "9bef8771-8c49-433d-aaa5-d800076ca4b0", "comment": "Malware payload (Prometei)", "value": "695dea3fb96769b54d3b109d959fdf36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924444, "uuid": "6a7566f6-8a82-4821-9051-ae5ac2e6bf6a", "comment": "Malware payload (Prometei)", "value": "20ce8bc22c90ee52649770909f490983e99b6f1baa2aebeddfd187ac484637fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924444, "uuid": "4d3f6d87-4284-4cf0-a953-b82197763c6f", "comment": "Malware payload (Prometei)", "value": "4b7ce04012e230f2ba9b655222d0f7ffa18873cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924444, "uuid": "018fc688-013d-4a1e-8c49-b0ac1abc1f11", "comment": "Malware payload (Prometei)", "value": "ba2219d7bf1eee2a833f4aba3c065d23c552b758d5239434079905b9e44b26b8d13d8cf293a7d977d748741773a4f632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924444, "uuid": "aaf7a5d7-f91f-4cdc-8e39-ec07f029c3ae", "value": "T19E155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924444, "uuid": "66ad65aa-a46c-4adc-b7ee-1ee0d2665465", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpln:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924444, "uuid": "d1b99cc3-4684-4bc7-8596-6878a46e85b6", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924444, "uuid": "1e05f66d-4fbc-44e4-addc-9727fa69b063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924444, "uuid": "f8c05e4f-308d-42bd-a54c-703ea98f4002", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ea3b79-12f1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743949055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949055, "uuid": "8df04c51-24c2-4fd7-bed4-9028695201fc", "comment": "Malware payload", "value": "32b94c353541206ccd3fed44cffdf384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949055, "uuid": "42caf3ff-c5f2-45c9-8086-196709c10cb6", "comment": "Malware payload", "value": "20d4937246fb0b05eb25e40048e6fb90f8541882467c8d1b6e0258a6565c51f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949055, "uuid": "3adb09e2-d627-4204-a141-01623eaaf2a1", "comment": "Malware payload", "value": "33b028aebd4c2227f7d3f36e1a3f9a87e6827bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949055, "uuid": "2935da94-9d82-4573-8088-330f843b7471", "comment": "Malware payload", "value": "b32cb19d86c8621763b99fb28963bff61f73f7c9473d4973b7b29215caf723f270a828d93a3aad12709d4a08175663f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949055, "uuid": "288d11fe-17e3-463c-b695-84da90096d48", "value": "T12492A41473E88521E6FB4B762DB183118372B9436932CD5F3ECA458A1F363948E66F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949055, "uuid": "81b9566f-21ea-44eb-b3d2-f74bad060f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949055, "uuid": "bca2c07d-c0ad-4ae1-9c65-c1e6c0a0ee74", "value": "384:nKtPrsO4mQqwjBx1vckM0pvX9iWAxDcpVly7YRRqd/Ca+CzYcHeIm:KtPiDmkM+9is0MRWlfzYcHeIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743949055, "uuid": "07eff847-9ce6-4fae-b431-e14dc492943a", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743949055, "uuid": "5e88265e-dda0-49be-ae61-f62b8b0325bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949055, "uuid": "a8574df6-b578-4610-a60b-ebae87dd4a01", "value": "Konsol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b411e9-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918354, "uuid": "d98114c9-945c-400d-8024-ca398fe0edc2", "comment": "Malware payload (LummaStealer)", "value": "5da257c36b4b11b171686722605f0bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918354, "uuid": "d83a87f0-177b-44b6-a2d9-94d1fd68ae8e", "comment": "Malware payload (LummaStealer)", "value": "226157c17048e909368185220feb55c88686913247d99a83ce50d36260ed76bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918354, "uuid": "720e8deb-ecce-499a-86f0-d25efce52e24", "comment": "Malware payload (LummaStealer)", "value": "78c8eebee43216136652211af09c07fe1f014390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918354, "uuid": "37ce3608-83cf-47d5-baef-37eb222b2775", "comment": "Malware payload (LummaStealer)", "value": "a6c6058b2e1998df9ec8fc19a7dc5127eeab82fa09bae1a858a5d3694a14de3b2050edb10435786b9c2e7bf06b39bbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918354, "uuid": "75a788f0-3f85-47be-8faa-4c3a8753d052", "value": "T1D4A522E1D5DE67E3E578CAB0F215E73E2231AE19E0C231E45651A8F31B23E5817BC492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918354, "uuid": "5147efee-a48b-4ce5-9baa-1ec9c201e70f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918354, "uuid": "ad08075b-ea86-4951-b633-ae3d0ab0004e", "value": "49152:hGTfzMTPyXxnh6yL/htMyX5K5qukX9NHLTKYAHWI0:hmfzMTPyXxh6Q/bZX7nKYA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918354, "uuid": "3c2ec1d1-4a17-4687-90dd-e2315e70c114", "value": 2109952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918354, "uuid": "d1697d3a-a954-4ed9-b2c2-383d2e9622fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918354, "uuid": "a77e1e7b-78ae-41e5-a5bd-919f3f72a32f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6666679a-1298-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743910621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910621, "uuid": "c351b588-2320-4ad4-85fd-a00335242004", "comment": "Malware payload (Prometei)", "value": "953dd49fb660cfda38ef5b67eb17ea32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910621, "uuid": "fb577183-6a8c-4708-93e4-6ea85d9d551f", "comment": "Malware payload (Prometei)", "value": "22dd9e307dfe16f93dce87be587f9007543234e73f8fc24653c455e89db1b10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910621, "uuid": "6cbe15e3-f6da-4e08-a95f-90b35758e4c7", "comment": "Malware payload (Prometei)", "value": "21594bd2175ae1bef40b907b5f707dc15b448ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910621, "uuid": "e45cde02-672b-4428-b229-85431457cb59", "comment": "Malware payload (Prometei)", "value": "927dafdce354bcfcd44409a352902bfcaaa9f4988356cdb18e1a4d9558a67fc800ab5b1a5725faf7de993476a06eac15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910621, "uuid": "8410cd26-8f51-4ea8-a3a4-057a03da286f", "value": "T1159423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910621, "uuid": "d8d89279-af89-4591-942b-930223a0820b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg7:25WOSACZSV6eKRH5EPiamb4DsDwwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743910621, "uuid": "247cea55-2363-4a88-8f40-64a353e0cb60", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743910621, "uuid": "a6714b2f-ddd3-47f6-9715-2d1afe1314cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910621, "uuid": "b4689247-83cb-4e13-938c-8158e624044f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5942f8c7-1303-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743956555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956555, "uuid": "bda4952d-95b1-4755-9c0b-d00a8ca18c1c", "comment": "Malware payload (Prometei)", "value": "e6520e62eb33fd406cbd03b071113873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956555, "uuid": "0bd1448f-14e2-43a9-bc43-ff3b8bf1eec3", "comment": "Malware payload (Prometei)", "value": "25b3c63c72ef4416cc875238deb5a5b355784f3441cb45471843ddce8678cbcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956555, "uuid": "22cd55af-0559-4d10-8a5b-49316ea470b6", "comment": "Malware payload (Prometei)", "value": "57c62322de883824169ad0675283cfa7c55b0a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956555, "uuid": "96c69014-a7dd-485c-9ea8-2398f8bac32f", "comment": "Malware payload (Prometei)", "value": "0e54d51535bcd0dfb0e235810df31628282d9ffff52c7444393199600b4fc6b480e11cd812626f0ee1b089a972aa84e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956555, "uuid": "7ee8cd96-81c5-45dc-a735-a0ab77056fc7", "value": "T1B3155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956555, "uuid": "a353697a-fd41-44c4-86ab-92879763bb8f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplI:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743956555, "uuid": "b30cbd8e-dd09-422c-a0c0-831075fa36d9", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743956555, "uuid": "26590fd5-28f0-4ab7-9d6e-6d84eb137f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956555, "uuid": "4f413a91-0e80-4a71-9bb6-8c34298ebf25", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3f9322-12ec-11f0-ad17-42010a9c0004", "comment": "Malware payload (Babadeda)", "timestamp": 1743946631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946631, "uuid": "1fa01035-0ea2-414f-ae52-f32abb685942", "comment": "Malware payload (Babadeda)", "value": "cff7759803a0374b7cc5cbcc4734c13c", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946631, "uuid": "2b33f8fb-c727-4b6a-ad1b-100c34d36edd", "comment": "Malware payload (Babadeda)", "value": "25f49d8fbac2a068fbc583e25bad20bfcb341f0720d510d996ef4640a4b68ffc", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946631, "uuid": "9322ee96-ae60-4c50-b6c1-b6d8ee3a54d7", "comment": "Malware payload (Babadeda)", "value": "2d63ebd8968ef8db43fa5c7df47faee6c98126cc", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946631, "uuid": "8807c0e3-033d-4e32-907a-366d2ee42522", "comment": "Malware payload (Babadeda)", "value": "96dde737471ef884842f37775a57e1d025864650bdc650880967bd0466e5d3cf30ca08ba9c358af729befb0226e113e7", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946631, "uuid": "1601e361-ecb7-463d-9aae-2a579c700437", "value": "T157F633C444BACF92FA2481B3D564E07F4A26B62733563F674F433D8588AA3A8587D4F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946631, "uuid": "0ab81d21-8e8e-452e-b144-677d74c705b3", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946631, "uuid": "6498dfe2-a809-46c6-808a-a6f235d2ebdd", "value": "393216:KAy23bEzNBsPlw6KuqBDZoB14oqPC87Lu0zLNg+:KMbHuoWZoB14hLu0FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743946631, "uuid": "aa1dc029-908a-4cbe-b817-0b42149f29ca", "value": 16209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743946631, "uuid": "41100189-9bb9-447d-9035-e898ba333e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946631, "uuid": "6af79552-caba-4f43-b5d5-606dd6b31bf6", "value": "nonagon_beta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac828d1b-12c6-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743930495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930495, "uuid": "26479933-07a7-4b03-a0e4-3876312c3f38", "comment": "Malware payload", "value": "72962a203ae12ed35f0b4e819fcd6004", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930495, "uuid": "f22eb697-5d56-4dd0-8940-3823ce339189", "comment": "Malware payload", "value": "2639beb6868a10b9189f2717920a790a2314dbda28865a145de49fe0008006b2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930495, "uuid": "dabccfe5-2e78-4070-88b3-88102a6516de", "comment": "Malware payload", "value": "b0f364784b527e5795337a3227ad29c10d45b0a5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930495, "uuid": "b9f77a41-bd34-481a-99f6-32e51a576b69", "comment": "Malware payload", "value": "574b4da89d45b43648c0262685a4f40c338e986871392d9178004b11e8fb22f742b1afed3cf5c9423caf295f0cfe078f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930495, "uuid": "f1b497fa-cf03-4b98-9ca2-a71947ab7250", "value": "T15D02FFDD53FC47150F9360E4198E48BC3A8DD825791DF125D888676BA6C82EACAFCF20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930495, "uuid": "71eb7a8c-9179-4b97-8465-eb0840133269", "value": "192:WSwypgehH7y3EFWDgDdiDKHzsjafRWKf5mpsXD2vJDvl2UZA:gq3bqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743930495, "uuid": "78110cfc-ba5e-472c-a43c-0874bc3ff2c4", "value": 8807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743930495, "uuid": "7f5fd21b-b959-4846-acb0-dac3e6c24de1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930495, "uuid": "ff7d08d8-8c3c-454b-af49-d27d4165e4b4", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85c04c3-1294-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743909121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909121, "uuid": "bda1b8e0-ba7f-4814-b546-a98d0a48129f", "comment": "Malware payload (Mirai)", "value": "dd0aa24ed5569a0c301e0c821d493abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909121, "uuid": "eef32013-43d7-4afa-9e6c-c59d9d94e29e", "comment": "Malware payload (Mirai)", "value": "279dd7c53c4054b96d745c41f8a145ffa2c4a50ab7022f69b5a5816cb4d9abf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909121, "uuid": "963bf959-0a59-412d-a94a-3608612fb93d", "comment": "Malware payload (Mirai)", "value": "3fe465acf01d32212e8ab165e09fd99b222bab82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909121, "uuid": "326ea980-9cea-41ce-b2f4-49a64e38ea35", "comment": "Malware payload (Mirai)", "value": "0f47e51d9aba5b16a1d53ba817e732e0a3e30fb091744a41476efa9d75a0f213e82fe420cfad347d1c7d4869aeafd5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909121, "uuid": "e9e7c9f6-fbb9-4de9-bdfe-4d3b3ee1a9db", "value": "T16F24F834E650871BC2D237BAEB8A424E3F324F9773EB36094A3476B43BD1B695D22511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909121, "uuid": "e34fd1b6-1739-40c6-84ca-d2d50418d1a3", "value": "6144:jg3ULHp2atw3S9arg0ozT3+/SGM/9A9Wmvt24yFJkWXi:jhLHp2atw3S9g2n+Sn/gWmvt24UJkWXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743909121, "uuid": "af6a9ad1-6bd8-4161-b48a-4cc00421dfda", "value": 216411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743909121, "uuid": "66cff168-6b38-4bbf-91dd-ff5fa729fbdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909121, "uuid": "e2d00663-fe77-400d-8c67-8e4b29e261d6", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f507538c-132d-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743974855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974855, "uuid": "e23a3cec-ba6e-493a-9cbc-450f585f81dc", "comment": "Malware payload (SSHdKit)", "value": "cf07ab0b9882ae3a44cd9aa5a11c9752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974855, "uuid": "def3836d-60ac-4775-a544-2d563d6d3053", "comment": "Malware payload (SSHdKit)", "value": "293f613d0c96303876847b3e5cf8a4da0fc0dffd74f1cdbb02592d27e6cf33fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974855, "uuid": "74c44913-c609-435d-bb42-a4c3085ebbc8", "comment": "Malware payload (SSHdKit)", "value": "e75c274d28cd8bbaab616421c50ddabff2950247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974855, "uuid": "f194e35c-9b5e-44ec-84a0-038b0a02b44b", "comment": "Malware payload (SSHdKit)", "value": "091011913a31b0c04dfbf178a60e3b068f9998ed8459618961fcfc9f8b5b2f8cd32fd94f916b2d0fd7f9362066ced089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974855, "uuid": "457b8c37-ac7f-4d1b-b8f1-b74e7ba980ec", "value": "T1B9356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974855, "uuid": "a32dc7c8-9a73-4c6f-a690-2097ca14d325", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvL:00BnRED/TwOjX0a5xTdvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743974855, "uuid": "0fd59a70-7c86-40b3-b361-aa44340ef914", "value": 1109146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743974855, "uuid": "fc301d15-6702-4fde-bf30-da036da8285d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974855, "uuid": "b587c3a9-4228-45c5-a6f1-8f3f38b4cbbf", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff667430-12b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743922044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922044, "uuid": "8cef8ced-ca6b-46cb-b93b-2ccaead50a75", "comment": "Malware payload (SSHdKit)", "value": "f85bc96693586c4d5814e81a2c26e1c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922044, "uuid": "f7625e96-807c-4e23-b6f2-8b8065e317d0", "comment": "Malware payload (SSHdKit)", "value": "29f31b5951736d7f685ee768aa3c5898e7c33786a3ffebbecb5596b1e0543b69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922044, "uuid": "08f7a858-7271-4860-96d2-c6c81fee7d09", "comment": "Malware payload (SSHdKit)", "value": "94a67913971428597510741266e03bfbf5f8d654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922044, "uuid": "6bc7e595-98a7-4240-8d7b-a839d20024d6", "comment": "Malware payload (SSHdKit)", "value": "bc3b6b47c703b692902512bcdd40cef88bf8e1d83611ee04be01390bf8037c06d59a5b195639f1f17289c378dcae3f50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922044, "uuid": "15ae3c2b-5fb8-4bc8-8e05-3a50c34b46eb", "value": "T1A3356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922044, "uuid": "ba41f6c8-356a-4402-97a1-412f66cbe5e5", "value": "12288:E8dASOYRNCAJump208iJftd7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO/8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922044, "uuid": "5c62e2d1-008f-41f3-8e6b-332961ad9ca0", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922044, "uuid": "a79ed97e-2728-45d5-a269-c76b6db25e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922044, "uuid": "b2f6ff00-2caf-4928-8ebe-0cdc0cc84118", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8980b67-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912127, "uuid": "e0a1052f-1c3c-4d44-9f3d-c044ffdba546", "comment": "Malware payload (Mirai)", "value": "3797fb80d290fb6ff6e178a3d46b16a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912127, "uuid": "9553659b-c985-4e81-8ca5-b94e8601a670", "comment": "Malware payload (Mirai)", "value": "2a92b9d8018685d9d9db232c73a27476f1175cf7f62a5bc99a7d1016746c4d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912127, "uuid": "6c121d1c-1c8c-4323-b71c-7dd2079dc025", "comment": "Malware payload (Mirai)", "value": "6bb78e4195c609e88e8b71d19fee45c3b5316b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912127, "uuid": "ab96618f-eba1-4124-8346-a0e6ed85d86e", "comment": "Malware payload (Mirai)", "value": "136abfa06995946aeb936f30c65d7afcff6d07c5494bdb14508320175f11bcc2c6d43ca1c67a703c7561bcefe859590c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912127, "uuid": "aa31a1a2-d4c9-436f-a799-c948890203c2", "value": "T141B34AB3D8692E58C324D4B4B1B48F7D6B539661824B1FFE196BC2B18443D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912127, "uuid": "356d8c53-18b3-40b6-8819-25b17748035e", "value": "1536:0adr7R4h6IMP4D1UyArDCdKCGYcGyP8ExiThWeVzQydhH+5Ec:0Sr7R4hlMwDQrDVCAP8LhWYzQmKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912127, "uuid": "6a5572f3-dbc1-4883-ba6b-d5a70c6ef2bf", "value": 109540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912127, "uuid": "2f47a29a-475b-4efc-b3f4-d0357e3b8b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912127, "uuid": "2ebe6200-4773-4c26-8e0e-8d5665cb20e3", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a35e2fb-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743915432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915432, "uuid": "84a48b3e-e455-4edb-89c3-d89448f704b0", "comment": "Malware payload", "value": "2f78a3ca3b5325cca5cac0a547740e21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915432, "uuid": "04453a20-8199-4e38-a453-51c36cfae02f", "comment": "Malware payload", "value": "2b03c5313d2167841cea9042d0903359d39a3f8afb08e396b879ab27542eafbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915432, "uuid": "4de0d6e6-deb8-48b2-8fb7-bbd87da78c33", "comment": "Malware payload", "value": "20d1ddef2ef07d4c207b4780519fbb3d74234166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915432, "uuid": "64d0da3b-c436-440c-a2e7-10b80688a8d7", "comment": "Malware payload", "value": "81477430f06169e7999892507c68fb1be53a0799b79a9458c4e1400a990aa59357550ba751e728c9c78babc10e4c13d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915432, "uuid": "8ec5edda-ccc5-438e-8614-df701f3a6f19", "value": "T13E2318AAF8028D7DF85BE77E54164E09B93163C152831B2A13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915432, "uuid": "e4c03caa-9ab2-4e18-816e-7c73d235f7f9", "value": "768:CK0eoVJdxD8xY2xXkCltdSxumlDx3MMYiP4Eq8DHwOGJJ:b0BD8xLVdSgm/3MMFP4X8DQJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915432, "uuid": "f1c638a5-5be8-4a2e-9986-1b5b076c1f2f", "value": 46676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915432, "uuid": "a2c20bb9-4fb5-4f21-bc1e-493b0081ecd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915432, "uuid": "d2f03b5d-a704-485c-a145-803efa6639b5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e1178c-12cf-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934076, "uuid": "836cbfaa-e4a8-4efb-9223-cd8e1a8d1b2c", "comment": "Malware payload", "value": "44003db88cc3d5897e2670292b2f1cb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934076, "uuid": "27a35bfe-cc07-4926-9e00-1348a8c6fc2a", "comment": "Malware payload", "value": "2b6129f0277a99913bfcd50fef38c90a89275b2b2a17b5ab6ae087e2e93324d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934076, "uuid": "d566f252-6fa2-4824-aa36-f05cd2c60435", "comment": "Malware payload", "value": "b249b92e3c505842e3092f36bdc091007cd1e9b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934076, "uuid": "f0ca2cdd-eac5-4ce7-be3f-6ff7a6af3461", "comment": "Malware payload", "value": "a674d0060a77ad36d6e49483ca2378f42b81ad857e2b1252f17eef53f33dda93fce3807cae693713104e19234c15b11d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934076, "uuid": "c01035da-6ab4-4c19-aafd-f36fec8b73fb", "value": "T10C2156E7A2750BC7599F9E1FF560D65A20C4C39B626B57D8BCAC282D0E5484CF108E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934076, "uuid": "612daba0-10fa-48af-810b-e272f910a57d", "value": "24:CXWwKt6NIf0EJU5j/gkkhKeXAetlz6x8X:Cmwan0EJU5j/jkhXwovX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934076, "uuid": "dc05487b-b83a-4c11-aa83-4c99275647df", "value": 1127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934076, "uuid": "0343d36a-3008-4f4e-8906-274e338cc382", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934076, "uuid": "261613a3-a10b-4d46-902c-87929ad56c1f", "value": "gw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54891f5b-1333-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743977163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977163, "uuid": "7806f084-0074-4d3b-a523-faab83b48b20", "comment": "Malware payload", "value": "e72cecb9fcb1fb1098c5f34e5cfc1408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977163, "uuid": "18211361-b82e-4d4b-a3e7-951a5df433aa", "comment": "Malware payload", "value": "2c1de8103e9352f87e9bcf236cc33d84b46013f78b8124ad626afc9b6f86d2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977163, "uuid": "5c8b58c6-b00b-4da3-95b7-04054882aa26", "comment": "Malware payload", "value": "2c25ff0f537bf6ea5b63c5b58a85c2c980fa1742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743977163, "uuid": "a614bbb1-988a-469d-98d0-0912233008c3", "comment": "Malware payload", "value": "ea3f850d1072d85e0b0421f4c8333d1daea7445adde64d3930d08516f01055a406eee97834f223620d76fe5104fea4a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977163, "uuid": "70b2f7f0-099c-40fc-8033-d59d79aec0ff", "value": "T1C9667C43F85490A8C5E9D2308A759292B671BC880B3137D33F54FBBA2A77BD46E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977163, "uuid": "d1edbecc-c8c0-40be-9cef-4b87b89b09ee", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977163, "uuid": "50b9a80c-5c3b-493f-8400-c4b10e41c055", "value": "98304:Fh3J/MxIIjkE63jQfhnbz6W0hYHemWkH5s:FBtMWIjdwAnbz30aHemWSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743977163, "uuid": "a6b73300-9b10-41bf-83bc-bc74bf09cd82", "value": 7038976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743977163, "uuid": "b6738077-5710-4b8c-8545-2ffad4905e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743977163, "uuid": "6bf06587-4e45-446f-a60a-f3fe6c0a402f", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5008f99d-12f7-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1743951385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951385, "uuid": "fa1434ad-f0fc-4cdd-9f77-d8f0ff501935", "comment": "Malware payload (XWorm)", "value": "7e9a2c5a22a20ed004e8a78b09088538", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951385, "uuid": "c5da4c50-0411-4603-b55c-57475cb249b5", "comment": "Malware payload (XWorm)", "value": "2cbcd7e0c5846c527b21d664282fbdd4e7dacb4ae431056bed06a483928aae71", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951385, "uuid": "610298cb-11b7-4767-b9f9-84c7ce674d62", "comment": "Malware payload (XWorm)", "value": "19ae7d543dae0c03f9a009370c6b11e6671be143", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951385, "uuid": "294e6354-8c3f-454b-9d5d-61adef70157e", "comment": "Malware payload (XWorm)", "value": "22b2fe1041ff053a49be155abd832dccfbd9df6ad0fae68aecccd39d26e00a5a838ee1d5b3477fb3db0fd889fa61c957", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951385, "uuid": "1051aa64-bede-452d-a1de-63630015d1c5", "value": "T1375327323112BDF672BE9D88E20038758C49355B63765A3CFBC388592E7A154DEF98E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951385, "uuid": "76f1d802-f212-4523-9c2b-0a68273ab0e5", "value": "768:HzqJiQ2cHYpy61/rSTF/jerUpYErZXfXE2mZmoTJ35rNevyxZriZ5Rym8IJuQIs7:ABHYU8UpYEr5fXE2m0oVh6Qm8Iw/sq9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743951385, "uuid": "cdd4550a-2126-4ecb-90a8-fa329ddff0cb", "value": 65712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743951385, "uuid": "dccdabe6-8432-4d8a-9691-34f572356e82", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951385, "uuid": "65fbab47-63d0-4363-a758-29d1348f65dc", "value": "dsfsdfsdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a67400-12cf-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934077, "uuid": "6d46e9f8-9168-40ff-8cde-6f2afbead578", "comment": "Malware payload", "value": "ec10e4ece7b2c9af179d2f6a1e43d0a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934077, "uuid": "67537e12-bab2-4c0a-9ee0-c9046181124f", "comment": "Malware payload", "value": "2cec1349f963ff8ceb42fc5dcda5be99667326e25d387482f7e11c38b91ed786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934077, "uuid": "0c2a0463-3df7-4aa1-b606-c405e0277ae7", "comment": "Malware payload", "value": "e0666e84e35f17603cf614fe791ede90b9dff77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934077, "uuid": "27d4d5f8-8948-4040-9967-bf6a4f6d4cb7", "comment": "Malware payload", "value": "d834c660f6093a784c4b95db465b52235d6941e791013412e289c85cd2252e405367bfe42a308852b0487459631a587c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934077, "uuid": "5e9b9898-b9b3-40b3-9d48-eb5fe144ada7", "value": "T19C839E72B4207D9ACC1925B6F4B0C639CB116AB140C21EB6ADDDF2744097E89F94EF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934077, "uuid": "954f9894-32e6-4a38-b3c4-3465e82e6c01", "value": "1536:WEb0HhSEDFsmRJpqIVhQmXkUyyNQHDoVjrlidTlnOnr:W60HtDFsm/s+k0aKxidK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934077, "uuid": "e02db3c0-695a-423d-a018-15e6bd51ea7f", "value": 86868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934077, "uuid": "e5d8df8e-8641-40cb-9409-5c3e889a401d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934077, "uuid": "a9ca518f-6988-4441-8f8b-2c1a0bda7925", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcb31ba-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935279, "uuid": "e3082dfd-e3b6-4030-a8d9-ce73e9684255", "comment": "Malware payload (Mirai)", "value": "a6c8df575d1339bfe37acd28c872fdb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935279, "uuid": "ce8094a3-2a04-414f-8d34-d3e8d56d97dc", "comment": "Malware payload (Mirai)", "value": "2e0b72e634c8d310c17daf49767824afa32b19ab1a016083a5c59a2cf4a52f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935279, "uuid": "d0d926a6-fa8f-44fb-abc1-b37205c37a4e", "comment": "Malware payload (Mirai)", "value": "9891908c93d9c685c0b60b624616b94e118b92f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935279, "uuid": "4829020d-2c62-413c-b7ac-53421ad41540", "comment": "Malware payload (Mirai)", "value": "5147ad98137ac1c31e6db89f0ac040940a487bbb56c54e91d9e4b42d4cbcb171a038ea507bea24c2c873c8f4adfa2e21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935279, "uuid": "aebc5a47-79d3-449b-9a06-e9fba6182e38", "value": "T1CCB2D06DD769F699CE5CACBA22CD0390AF85D0B4334F9B485B214984B3F5957EC880B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935279, "uuid": "8a40bd4c-debe-47c9-9196-699fd3575bc6", "value": "384:rKSWSmPIBpNwsOS6kUOf4KDpQGGlzFOd+/rt09guR29VkO5RWGVCz0NvOj:eSHBpNwsOBkUc4KVlGlzNKgU29hWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935279, "uuid": "7fd37ebc-e081-4d1b-a2a3-a2179aa674c2", "value": 25256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935279, "uuid": "f713a406-4700-492f-9a0f-84358a69b882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935279, "uuid": "839fac21-a693-449c-8fac-7660165f933f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109275fd-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917349, "uuid": "1fb9527a-d8c7-4fcd-a5f6-32331d9fa9e6", "comment": "Malware payload", "value": "d8098397dc621a4962753249acdb1c66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917349, "uuid": "0f575553-d8bb-49c7-a145-543559eb655a", "comment": "Malware payload", "value": "2e2b3b66961445c504f5558624aa96b609a9860d2f22d88746d2f55bbb3769a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917349, "uuid": "765f8e6f-bc62-4a9b-8744-093b9acfd218", "comment": "Malware payload", "value": "7209e7cc01dd837bf45e6ac5c90efdd0b6f8ced3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917349, "uuid": "e716daa5-0ff3-48fe-ab80-836d079011f6", "comment": "Malware payload", "value": "74205cc3417331397b3774c111ea2e5173301d2cbf0b41ffc3fd1b28b6280ad70e5fc87bbf09d2bbca6b03ec3a78d167", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917349, "uuid": "2d826616-0d9b-4712-a871-91fa2c3f571e", "value": "T15D911E1E18E2202A865734BCCBEF520CE539960B1A5D8C503C2D6694AF7833D57F67E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917349, "uuid": "a1d0057d-ffa9-483f-a127-bbc9723ce2a3", "value": "48:3/ulviezsYFlGbQZ1VAwSCapSyoIroT45l6+AS2TdS2WEoH8IMeQGMRVSLj:vulvi4FfbFSCySKX5l6tT81FYGMRVSLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917349, "uuid": "c91962bb-7477-43d5-b44e-7bf14ba0e630", "value": 4232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917349, "uuid": "e4bf8e9b-6ed8-455b-ad4e-1831aa27a34c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917349, "uuid": "f75237fc-129e-4046-ac58-a0070d813fb0", "value": "e996f00bd63.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92058be1-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917995, "uuid": "d587b230-c1a1-4230-8c2b-7a372ce89106", "comment": "Malware payload", "value": "b324177947fd4d6faf4b2b313b069571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917995, "uuid": "81ba460d-f55d-4619-8470-ca31b43e146b", "comment": "Malware payload", "value": "2eb373cbb792fae5bcbea81bc4f2e514e8ecb338ab963b8ef1c48b0ed4783c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917995, "uuid": "9f57672a-264e-4e76-83d3-205b6d15ef1a", "comment": "Malware payload", "value": "518e7b567494dbf8b01a8f9f7829b7474df67e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917995, "uuid": "ebace1a5-ad86-4dc8-b93f-f1d4bc4905f4", "comment": "Malware payload", "value": "a4edb7a2e3b5ca606053153237cf5ab783d156eb4be4a4565f0b9abc2ddf9bf2951184ced53e57a80fcb225e0a74c0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917995, "uuid": "bb80f968-ddc9-41b4-90c5-0e15a70f36a8", "value": "T18DC5E109E7946CF9D0A7D378C892160AE2B778588735D71F23A0DE291F273609E3B716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917995, "uuid": "9be43134-6e06-447c-a714-60c1878e6c92", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917995, "uuid": "f6803a44-cadc-4f10-98cd-269e98634b2d", "value": "49152:fDjlabwz9tdiOqeEadJ1VQ7zu/sSpBPPzbhmBOBfJXA33XlBaAyBSJtQd3i/7Vdm:rqwLdiOqeEadJ1VQ7zuRN8BOBfKHXSB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917995, "uuid": "eda6faa4-9b97-47f5-aca0-8f9f574944ca", "value": 2577171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917995, "uuid": "b4c7ee66-5a28-49c5-8202-46d98e98f16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917995, "uuid": "285e8631-be30-4e5f-977d-9b08f0a347cf", "value": "WinRarInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b014d2-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918384, "uuid": "52adc033-28a1-4a86-b777-5752e9cf8b6f", "comment": "Malware payload", "value": "f1ee1b9279ee9516177e708058ec2d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918384, "uuid": "24137757-04a8-4df9-8656-2ac6f563d94a", "comment": "Malware payload", "value": "2f25d871d72fc963b215b5ccc81d592c7036f32403d48ad83f16d6749c19fa73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918384, "uuid": "53c05de2-fa6a-40b9-8f4b-5a402b97cdca", "comment": "Malware payload", "value": "3c5a563d382baad312c70fb66ef0fbac3c602170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918384, "uuid": "03c2987f-d924-4a1f-bc13-b4c55aa7102e", "comment": "Malware payload", "value": "5f51d5e96bd10c9df6cad0c6c1083a6040d193698df5a23a27a8a1e9ea90af08287df4c8a246e72224e8d148977bafe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918384, "uuid": "6fd89f5c-dfd0-43e9-804d-f229c043067e", "value": "T193B53306CE61CC7BD51ED2705B016426BEEA5D200BF3909C2B5F0AA27987B1FFB15E58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918384, "uuid": "ba4b7761-4c6d-4540-93ca-ef69c37562cf", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918384, "uuid": "cda25d1c-eb45-45a1-b3e7-7aeda98fa1be", "value": "49152:gyEzf7gf9vOwn0SEPTSrltOF7e6vaoW2:glYlvOwW7SrON1vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918384, "uuid": "41bbcf2d-2ad9-4b49-8cc9-893a2d87869a", "value": 2458624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918384, "uuid": "0f9bfae6-2834-4b69-b8e1-44b978ced8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918384, "uuid": "1793e409-b465-4341-b62e-be79e0fc0c9f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f961f3ed-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934060, "uuid": "a1f2eb85-f223-4d4e-9d53-69c5dab45389", "comment": "Malware payload", "value": "6431694e1042c001beccc9b530077a9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934060, "uuid": "438b3eef-56d5-4873-b18a-54e65fa7dab2", "comment": "Malware payload", "value": "31368ddfb8ca2b7a334ea6986311b61c49599daa94d9c41598cdd7f25eba1ad9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934060, "uuid": "af4d161d-d155-485f-bf14-acabc2362c95", "comment": "Malware payload", "value": "ecfc6ca51a882fa03131e3fd0c3040d9874b53a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934060, "uuid": "fc65dbfa-26c8-4404-996b-50defd2055f8", "comment": "Malware payload", "value": "63497fb8624380fbb13066d40af26a5e172c881d7579dace330062201aa21d76b2a1ccfa06f666a4e16cacf6c1b40384", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934060, "uuid": "110bb04a-6f0c-4f2a-9d29-652af0c6e0bd", "value": "T18811E7EBE4540B16840EED1FF537D55E3050C29B526F07C4BCDC243DC9D9D18B224A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934060, "uuid": "1ac67176-77dd-4bfc-ae23-21d5bc733a2d", "value": "12:EaahsXRaPp7mdRfAj9xrtY/X6NIl5wLGjn0LKr3AtpJZ8tST:EaahgkRJj9xriP6NI7byKrAtpJKtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934060, "uuid": "17de03ee-c322-4cdd-8dea-3e533bd936c7", "value": 915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934060, "uuid": "b18adfd2-b098-4231-a84a-1d4d557b56dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934060, "uuid": "80fedc33-9ece-4360-be0a-5cbba89c9252", "value": "bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a452ce87-1309-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743959258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959258, "uuid": "029cc160-026f-4259-afcd-860df734db38", "comment": "Malware payload (Prometei)", "value": "77ab702899cd8c20ba6194d1e10eaff1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959258, "uuid": "a6fc48e9-cd4b-4931-817b-9c8193d16ab2", "comment": "Malware payload (Prometei)", "value": "3188a937530fe5d38a86eaacee6c38862ce4435874e57d9a0154e4ca00307157", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959258, "uuid": "61a0ced4-bdce-4e8c-8754-2db493911524", "comment": "Malware payload (Prometei)", "value": "6170d29bee18ad35077095c06c63926f7fb6e28c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959258, "uuid": "c7db3f20-b0b0-42eb-b73c-6b3a804c0e64", "comment": "Malware payload (Prometei)", "value": "a3e886f703cb4d90cab276e8804222458a90d229ec5d16f33f10693d5e2290e5b1739e30507eda23fa4d41198e97fcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959258, "uuid": "34457069-f8e9-4544-9c24-6c8fa3b2baab", "value": "T1319423F8C83D2E3198169B3CBB1A826CF0A15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959258, "uuid": "95fc26ac-6b6e-41bc-8afc-378aef01f554", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgt:25WOSACZSV6eKRH5EPiamb4DsDwwcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959258, "uuid": "90023094-d800-4e11-b261-37b65670d385", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959258, "uuid": "6ae11300-7c6d-4f6a-8290-e4e87cb87b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959258, "uuid": "014d7723-8b62-481c-baf5-2d4e0452a58d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e45313c-1314-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743963757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963757, "uuid": "9f8d40d4-3a37-47fa-b317-d98dc659587b", "comment": "Malware payload (Prometei)", "value": "6935b04b948da75c4b6d870208981729", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963757, "uuid": "2b135a25-e809-42f4-8b37-b307b6a0d701", "comment": "Malware payload (Prometei)", "value": "319834b7a108d7199c0278450fa9d6e62641d21939e65da7fc5250448dacb917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963757, "uuid": "8413e927-0c05-4f98-a238-355d7099dd6a", "comment": "Malware payload (Prometei)", "value": "c41a7e12305343ca6202215b5440816289a6579c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963757, "uuid": "67e7d540-a369-4f11-a7ba-2199f5ef511b", "comment": "Malware payload (Prometei)", "value": "c5e8343c6399d72d219ff14d499cd64ea34349109719900d63fd94efa84d15af3ab7aa60e076119faba453b15501c19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963757, "uuid": "a71b2fe6-bcad-4dfc-87b4-2724a658e2e5", "value": "T1F19423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963757, "uuid": "a261ef6d-6ca3-43fe-a8f6-51c73ee368f0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743963757, "uuid": "330a7238-3194-47b0-9375-d3f809273f94", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743963757, "uuid": "449a7c08-819f-4af2-98c4-8d16681cafb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963757, "uuid": "93c6cae1-15d4-4747-b28d-23deeb7b58b6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5670521a-1281-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743900715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900715, "uuid": "1ccb979d-9a1d-4dab-8ec5-34afdc77773d", "comment": "Malware payload (Prometei)", "value": "39270162f96bdcf4e62784c9abe3573b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900715, "uuid": "08279358-b1de-4786-9010-a27400c24ef1", "comment": "Malware payload (Prometei)", "value": "32eed0f23891f82647f4e59dba8ddc86099fbe34300d551e8d5f96e361ca593c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900715, "uuid": "a933e747-fc7f-49ba-bbc8-6caae1e46303", "comment": "Malware payload (Prometei)", "value": "4cda516337ed836a1c556af06db33bba6e319caf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900715, "uuid": "22b8341c-a350-4ded-911b-704dedeaae19", "comment": "Malware payload (Prometei)", "value": "e1e95d6100d9031fc396e7d60977d1273224418af07a21e18836cbe0cc479e0284db5a405e7e2fd892ce0b5890ad4da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900715, "uuid": "702ce7d4-4a76-4cd5-9456-660e5a2aa5b9", "value": "T1139423F8C83D2E30D8169B3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900715, "uuid": "71fdfb06-0d34-412e-a321-2b22f585cce6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900715, "uuid": "0ee3b04a-0449-4f37-ac57-faa7b6f8ad34", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900715, "uuid": "54c3b5fc-c6a6-4478-a86d-c102f77bccfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900715, "uuid": "8765e984-3c2f-4398-afa1-d68bb51f56e2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d350789-12f3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743949663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949663, "uuid": "fb7a7fa3-e21b-42ec-a8ba-2067d615f972", "comment": "Malware payload (Prometei)", "value": "ee05bd6ad54f9e2e8eceb23c4ebab0ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949663, "uuid": "7f907f9c-92ec-4e5d-85d4-e2340395e358", "comment": "Malware payload (Prometei)", "value": "333b410ac447e58cbfbd2851e1bf272411491fc567c5f0745f1fa62e19494496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949663, "uuid": "365a3954-874f-4943-aab3-d9158f2b18f4", "comment": "Malware payload (Prometei)", "value": "f735d41297d4e4e1ed833af3799759d12b32673b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949663, "uuid": "60b9728c-a43a-4f72-87b7-9f5fc89cae51", "comment": "Malware payload (Prometei)", "value": "db9a8f77d1a2c42992965b6e1a1bb1efc5fef954be306b368d9c0e8651ccb70e0d259fb20f3edbbef28cf169977e7cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949663, "uuid": "31c59f0c-dc15-4dfe-ada5-efec28cfd8df", "value": "T1A6155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949663, "uuid": "bcf1b308-cf43-469b-ad72-9cadcbf475fb", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl2:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743949663, "uuid": "d24d0740-6d28-4a2c-a71d-9af9634fcb7c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743949663, "uuid": "96285070-f1ef-4385-bf62-52c658686792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949663, "uuid": "ca968a33-ea71-47a6-87d3-c5ce460641e5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b726d77-12b5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743922950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922950, "uuid": "4aee9911-e837-4534-95bd-9f2b3877b9aa", "comment": "Malware payload", "value": "cab6684ed68112d8e8d51f6866c417ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922950, "uuid": "bace620c-599b-4bb8-a634-10621d7114c8", "comment": "Malware payload", "value": "335c4dc4d67fc2b6ac7a27ee215799e1954da64d3becfb8429d0bdf65e9018f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922950, "uuid": "6ba37107-a8d2-4d9b-8519-901beffc76af", "comment": "Malware payload", "value": "345190c2bf6e8305d27c22d633dafa38c233dc87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922950, "uuid": "df33db01-b130-49d7-b965-19143fa221aa", "comment": "Malware payload", "value": "4caecfb2c4e0d71c07e6c2e7630314f05cdb45c96d886ddedbb9e666bbdac957e989f9a4aaa391dfc2817ae75a4cec7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922950, "uuid": "acb04216-d259-4a97-8d88-c5c6a38377f0", "value": "T17AA34B4177090157D3A71DB03A3F1BF197FB4E5221A4A146681FF79986B1E33680AEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922950, "uuid": "a3cc98f7-a26f-4887-9b15-cc85369c97b3", "value": "1536:tQ/3eiEXHMgWvCqMNkD6UcsSQ/RbEbU4fMQfd7thX0qLNyHldTlnOOr2:fbZbkD6xzlkqR+dn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922950, "uuid": "f9a4fbda-2d48-4890-856a-86db2d6f3c28", "value": 103236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922950, "uuid": "f63b3f55-2295-4c8b-ab4f-1702c80a2038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922950, "uuid": "7f788a97-66c1-4cff-96f8-03281bff39d2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3b3f62-1292-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743907917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907917, "uuid": "08a08714-974b-44d8-b438-755c5a2fe606", "comment": "Malware payload (Prometei)", "value": "4331bcdcc2faffd5509da015a186d060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907917, "uuid": "54fce434-42ef-471c-b31c-4a4d77f52cb6", "comment": "Malware payload (Prometei)", "value": "343bfcfe0751d36bcdc7cbae52fec65c2f80c2427241ca199c230eafdf56cdf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907917, "uuid": "a41bbf09-26a0-4881-85ac-ca8541065a43", "comment": "Malware payload (Prometei)", "value": "e869a6b687e4e6c7ef83df9479299411d63e4665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907917, "uuid": "d01c969f-cefd-4d63-bfe5-47af6a03a645", "comment": "Malware payload (Prometei)", "value": "59622d428b95136e6a4c2072ac7db096e1389793e59467acc5f9526c4e8ee3f41935da6be83fa1d59dec6e2b285bd269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907917, "uuid": "fcbe7ced-fbb3-4801-b495-6edf1b98d385", "value": "T1459423F8C83D2E30D8169B3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907917, "uuid": "27365f7f-8028-4763-b67c-b40061a65ee4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgB:25WOSACZSV6eKRH5EPiamb4DsDwwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743907917, "uuid": "64fbba4b-ad39-405d-b7ed-48ff5ceadd70", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743907917, "uuid": "b80ae9b3-accf-4e1f-81cc-2a81e6c151b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907917, "uuid": "95ac868b-236f-4561-808f-d3ecbce82fbc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41f288f-132d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743974853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974853, "uuid": "55c86cc0-2daf-4dc3-8d76-300afe41a28a", "comment": "Malware payload (Prometei)", "value": "572f214d05999cd0290555e75d163324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974853, "uuid": "d226d0f4-6037-47e9-8be7-650878251efb", "comment": "Malware payload (Prometei)", "value": "34ecb5add1e0a0f9ba595c59156196dbb3a2330923a36813cec5cc8fcfce9f0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974853, "uuid": "a13ee9e1-f899-4f25-8376-22a1352fe12b", "comment": "Malware payload (Prometei)", "value": "53ad51db25b83cd7ae930d7209f39565afd8d930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974853, "uuid": "8c5565e4-a393-4812-9252-320b9a9aa385", "comment": "Malware payload (Prometei)", "value": "a67f1a28acdc09efd430ff7b0a924e8413f42533783b6b98c3c9c828ab8fc02b44e76a762ff36dc0c660bf412aaaf875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974853, "uuid": "e0efd7f3-7d28-485f-a88e-607d507db54e", "value": "T1FE9423F8C83D2E3098169B3CBB5A8268F0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974853, "uuid": "e6ba0c3d-ff4c-45db-9e27-ba84f6afed07", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743974853, "uuid": "2fdc66b9-be2c-4dcd-979b-20b1e19fa44b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743974853, "uuid": "bcc6db17-952f-4088-9b1a-2e55614b6d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974853, "uuid": "0090fcae-e2a4-463e-88aa-4b154e911f61", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7b185f-12dc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743940078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940078, "uuid": "5ed82fac-5007-4a12-9eb9-bc6ea304d384", "comment": "Malware payload (Prometei)", "value": "6acbae8cf808c2d487bf3fda645f9194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940078, "uuid": "83c3d6a1-71c4-4024-b5ef-50898dc9018f", "comment": "Malware payload (Prometei)", "value": "34ed80bf071d8a07fdc50be95b7367f2f9fbd9c451b49ea94aaf957332cf4cae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940078, "uuid": "26644ade-b4eb-4550-bbf0-11df9494d33f", "comment": "Malware payload (Prometei)", "value": "7247363a96daa253cf2abcf48009b58a703a41df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940078, "uuid": "1b651169-0704-4839-bd63-b28d840a893b", "comment": "Malware payload (Prometei)", "value": "15af3b68be521b7f0d38e03bc4505ac5c29051023f199c2044e569aadaf9832872c8074a94674f893b071b61e5172ad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940078, "uuid": "9a848a2d-2fc7-4273-bc92-bd9511a06c6d", "value": "T1439423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940078, "uuid": "1bceacfb-fcdf-48d9-9a89-42d56c159dad", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgL:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743940078, "uuid": "35ac9aac-0275-4f76-b3a9-dfbfe6d94b6e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743940078, "uuid": "68dafb52-a77b-4717-b931-0e5dbff0961a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940078, "uuid": "9b6e6a7b-04e0-4ac5-ae1f-c1b2d2ee303a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2cc10f-12b5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743922953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922953, "uuid": "dccf6dff-c232-4c03-a284-2bd6217e9568", "comment": "Malware payload (Mirai)", "value": "62d9eb24a3fb02e7860a7c2acc7eecf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922953, "uuid": "658aefe4-79c8-4660-9da2-d3a1ed5d264b", "comment": "Malware payload (Mirai)", "value": "354fec084612752460b60642a3cf8b7b415d62fcab48e9b08115e590e6226cbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922953, "uuid": "251b631a-c413-4177-8520-fb182712ea10", "comment": "Malware payload (Mirai)", "value": "93322cfc7622407166b53f9fe5649844a71726be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922953, "uuid": "83ec9ff9-ca1b-4bbd-9287-82965caafb33", "comment": "Malware payload (Mirai)", "value": "baf9db3f133cd055cda4d08fd8ee69641495646e9ad5a5c46774d855fa0075240bbb526692ebf9bfb9a17bdeb2eca3f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922953, "uuid": "bd25cb5c-01e7-40de-8af5-a8972a275cf8", "value": "T132B3F65AF8819F66D5CA15BFFE0F928D332357A8E3DA7203D9146B2037CA51B0A7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922953, "uuid": "bb0695f0-787b-4aa4-99af-f843a412c81a", "value": "3072:uIDgW9E5UEtTJQxpPM4KOcLLctVwlaNlwd3cz+aL9AtCHaBd7:uIDgW9E5UEtTJau4KjKylaNlwd3cz39M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922953, "uuid": "5d16d5ce-224c-46c1-8951-7eed5afcfa81", "value": 114920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922953, "uuid": "c7e5991c-554b-4f49-9a4e-47f6598e8b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922953, "uuid": "862ed4b8-0122-47a2-8a20-eb30f5755d43", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa471de7-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918170, "uuid": "c9c510cc-602b-4c39-a27a-71e489da69d5", "comment": "Malware payload", "value": "9dea00f5560fd8a1f3f9ea47d65b7525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918170, "uuid": "95c1bfb4-01d8-443e-9ee0-9e6d709ee28e", "comment": "Malware payload", "value": "368703f7e54c8fd2ee3a817957078cb9c348de15caddaac67236aea1ec48589c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918170, "uuid": "0a365d53-9f95-45cd-acfa-54e30512848d", "comment": "Malware payload", "value": "2c2b0b74fcd167c02b716175cdf48eeacff6eabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918170, "uuid": "78b95330-d0d4-47af-a6e9-24d033be6a9a", "comment": "Malware payload", "value": "f08eb56ca7890dd71fd6b9f484a141124c8c3a6d34edf7ab19807b5954a11b80b999f01f4bb9ec8259d70cc90b0f2f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918170, "uuid": "e51fb50b-ff58-43ef-a81c-e382d79dfbd4", "value": "T10AD3A6A03A1ECF67D9919EF499285B6FD20C9B0E0794F4C7A7D85C5B64B02DB1A31C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918170, "uuid": "5fea606e-26e2-4aee-989e-288dd16f795e", "value": "1536:Q7QiOq8o0ttGATxJZLjscB8a6mGdiYoAC8VWfwRFKWgzWVtvH91CwB:QsiRg5xJZLjs66mGAYLVkvWVVH9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918170, "uuid": "947adb0b-07cd-41f3-ac43-29132c41d728", "value": 142814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918170, "uuid": "a185b04c-8b69-400d-a558-fce054d049af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918170, "uuid": "9f491b23-80d3-4681-8017-5e9657b172d9", "value": "NordPassSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a1b3f-130a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743959657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959657, "uuid": "dfff81ce-1cac-406c-9991-0c78f3ce6bc7", "comment": "Malware payload", "value": "e51d28d9060ade898b2b05a738509b5f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959657, "uuid": "4ffafc3b-c932-496e-8df5-2b00a2266cab", "comment": "Malware payload", "value": "3690b073d01f2a11668c31174239e3d6f41f86e8e037df380a78b787abc5bcaf", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959657, "uuid": "d4ae3010-8d4f-4621-88a1-7a31b3c89ac5", "comment": "Malware payload", "value": "fb34becbcb9ed94b69f52d8d49f1ebd4a3147ba7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959657, "uuid": "feea5699-bb97-4747-93ba-8c401797d94a", "comment": "Malware payload", "value": "aeaf79de598c3589629ebc2be64d2a0e8e5e5ad4f66c8b030d84d291899e8a93c231981ac9c3935e3b1e368648460d17", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959657, "uuid": "211124a6-80b7-4b3f-ac7d-21f864eaee29", "value": "T15232E56009F2CECEF015421EED6A4C265BF6983D60746D9AACD8F4FC07D5239AD5B0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959657, "uuid": "32b39088-7eeb-40a4-8ef1-992edc6c899d", "value": "96:ycZfA92JsF6swb2D9jhZ9dTNvDYOhtinFP:PZfA92JsF6swby9FZ91NLYO7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959657, "uuid": "7d75736f-6303-4a83-ba06-f3598b877782", "value": 11780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959657, "uuid": "393a4549-e53b-404a-b318-4fb71c574ccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959657, "uuid": "cbbaa18a-4da8-416b-a2f7-caaaa66bdc29", "value": "startuppp.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc57565-1328-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743972457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972457, "uuid": "430c2652-c42b-45c9-b2f0-8dd38b27a26e", "comment": "Malware payload (Prometei)", "value": "cf04ab43bab35e2010346c0cd3f13d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972457, "uuid": "6780c499-6c93-4b37-9a26-7e6179113159", "comment": "Malware payload (Prometei)", "value": "3716f69f35d66cbb7a0d316efa6e68ac4cabb851e42e09dbfe95a06439d04b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972457, "uuid": "99a2f230-74a1-4cdd-8436-dceeca37481e", "comment": "Malware payload (Prometei)", "value": "a692da474a15d8a6348ee61b9f9b12509e4b4cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972457, "uuid": "372c9a48-127c-4c5c-94a0-5cb67be640c1", "comment": "Malware payload (Prometei)", "value": "5304f92ed70100959079bf6e804b0616ea6f1453167d78547ab917a4b88a77a9197071d64af1999726ccda103a2d9ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972457, "uuid": "180ea26f-15cc-4bcf-af9e-785e857ed169", "value": "T1169423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972457, "uuid": "4dcba1c5-dd42-4545-902f-a28c9ed4f7d9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743972457, "uuid": "779c7470-6163-414c-9435-a0114ff17f4f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743972457, "uuid": "74f4a604-d34e-41b4-b740-d13121543775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972457, "uuid": "7554e74e-fe96-4ea4-aaa6-206cd304c7b9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab9f875-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912131, "uuid": "85596ee8-91b1-4f93-a5ba-6f35e244cfdd", "comment": "Malware payload (Mirai)", "value": "e6db3140908ddfcbb2a734a7a8d15e83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912131, "uuid": "a813aff1-88ae-44d4-b58d-b60e447998db", "comment": "Malware payload (Mirai)", "value": "3731bc9381e5bf59c8d2556a672b1aea55cd09b124631bda666f8c5f36a79902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912131, "uuid": "9ac85e5d-d12c-4cde-9cd0-8aa48b69c9c6", "comment": "Malware payload (Mirai)", "value": "02adb834030ef294433be8d05224538dfa34127d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912131, "uuid": "f8c59850-e827-4378-a075-efeb503368a0", "comment": "Malware payload (Mirai)", "value": "eedd91711873280e4cd5cc0272fcd907e767e660891886ff7f07e2b3b6b68cfbdcd4ce37387d4862cf2c525c7df0669d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912131, "uuid": "b7a902e7-0b1d-4744-8ad2-864ca03f7169", "value": "T156F2F1159F09F22FFBF5C3B3216847678ED4048273AE65D2A82D45F2007369DE835AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912131, "uuid": "22e68bee-2722-42cd-ad8e-4f1bc2bdefc8", "value": "768:nLQVXj+/kBAB+V7xjxd+7lCqxUwwn0b30zBOCWMK2rmk7F2aO:nLwE+9dd+bxNHb32BOTt2ik7FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912131, "uuid": "6390733a-0494-471e-837a-2b0645b7b923", "value": 35720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912131, "uuid": "00e8d848-aa2f-4c50-af3a-1dba1d04b96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912131, "uuid": "0ddf66d8-1056-4a47-88bc-b261c4b38d7a", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d671b615-127d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743899212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899212, "uuid": "caefdf9f-2059-4f68-af7b-78dc04d90847", "comment": "Malware payload (Prometei)", "value": "4db5af4dfdab70451e3db6f77e206939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899212, "uuid": "f593d3a5-4d16-47cf-828b-925544a18a71", "comment": "Malware payload (Prometei)", "value": "380fea5f062ffd98f6ad1d80aaa067bfded23d61f28fb0fe69b5728470f32fe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899212, "uuid": "80761372-cc0c-4fca-8f04-d1f2187242ef", "comment": "Malware payload (Prometei)", "value": "e0e27325bf1b579bb1d2f5a62c976c0c08f4e6c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899212, "uuid": "7171d941-29ad-42a0-ac82-dfeb488ff2d8", "comment": "Malware payload (Prometei)", "value": "c9e7430bd9cb335f204b1c3b266e2511c8597cda3bd48d88345b4ea25e89b79885516f9f622425cf4d91a6e72eb2644e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899212, "uuid": "a2242d67-7af9-4686-a9a4-ee4ba4f0ee96", "value": "T14D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899212, "uuid": "365f3a0b-1a11-42f4-ae92-c8554bc9a00e", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplI:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743899212, "uuid": "801122e5-260f-4df8-95b9-031f664f350c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743899212, "uuid": "7c7da0c9-7e3f-48a2-98d0-fe11933efbf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899212, "uuid": "a28b5d44-01e4-46ae-adbf-040f18159497", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efc705d-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915440, "uuid": "73ed9c1b-8bc3-4151-9c31-fac95bb803d0", "comment": "Malware payload (Mirai)", "value": "382376cf38e99d20606f5ff690fe07d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915440, "uuid": "422f2493-9902-4c03-b5fb-590e11cc1d18", "comment": "Malware payload (Mirai)", "value": "38c4ef26c27c61b9f1bc59e1324aeb858b03f42e47864a36a39a8181801d7d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915440, "uuid": "d059b62e-b705-4388-956b-153d0994328e", "comment": "Malware payload (Mirai)", "value": "77b4cd1ce95e56b1d38844a76a2da30eeb59cb71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915440, "uuid": "97b10c0a-49c2-4f72-8e4c-1edc6637121f", "comment": "Malware payload (Mirai)", "value": "987b14648187928db1f0ba897fff58c10101f4f355747ac2ff80c647001dab4fe9061a78a783d1c3a2ad83a38822f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915440, "uuid": "a1d7023b-52b4-41f6-bf05-a728a6209878", "value": "T1A153B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915440, "uuid": "2e1de315-9030-45a8-9967-2c35e3d13724", "value": "768:iAVWeGUx4YGMmnwCw5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWds09wxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915440, "uuid": "ea3e64eb-319b-4e23-adc6-41a352f75bd9", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915440, "uuid": "6f896228-2111-432d-bf16-2eb87a722b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915440, "uuid": "5a0cae1a-9327-41f1-b9c1-27bdbaaec52e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9468e0a-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743939080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939080, "uuid": "e19c43e6-99ab-4331-8c4c-a1063d9c2abe", "comment": "Malware payload", "value": "cd23af28fe42d88725e40cc58897eaef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939080, "uuid": "23fdfb91-8543-4b54-863f-482b9197ec62", "comment": "Malware payload", "value": "3936ed0b6e7c6712b17a5abbc4e22c6b07fa7adaee435afc4c598e2c9e223929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939080, "uuid": "d0dcb93f-37e0-4ed7-b6af-8b1988a15a17", "comment": "Malware payload", "value": "82878d0fd204c77ea3deceac6a675f7b06c4fbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939080, "uuid": "de08b1ea-8d99-4b7f-822f-2ea2e87f0287", "comment": "Malware payload", "value": "58b5c91af2c9de4b19707b7b5fcde52f5af19fc8f4f9350033cb0713e7b4ba3c8fe1bb4de5822b4b61c7e29ccabb15f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939080, "uuid": "b68b9081-02d4-449d-838b-689897d88fc7", "value": "T16A74D004B26109E6ED63827E8B658641F5337C27C734EEEF02A446121F17ACD5E3EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939080, "uuid": "f2c93791-0d98-42cc-b113-0386532d1a0c", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939080, "uuid": "069062eb-6e0e-4e28-9bab-52521be1d875", "value": "6144:QAJvsvm0Pw0soTmUX9ED2sZAZ+Hr8MAC9GZp1JfJGJ77NnvHbUXyaggUpHcex5K:QAJvsvm4soaUtcLZAZsr8MAO0p/fJGXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939080, "uuid": "aec02108-2c8a-4777-aaa4-10e41296d439", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939080, "uuid": "28d9494f-cfb9-4006-aa22-64cb113765a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939080, "uuid": "c44b4c12-9de4-42ea-8804-1ce60106db25", "value": "5uMVCoG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a52542-1289-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743904318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904318, "uuid": "ab4f6404-634d-43d3-a8f2-caf747bdd313", "comment": "Malware payload (Prometei)", "value": "71dfc550636c24c77becedc0caf4eca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904318, "uuid": "de56c3b4-42c1-440e-b310-204b7d61e12d", "comment": "Malware payload (Prometei)", "value": "3b14fcef03582498e7947759b070737a436eb1cb6e13b03bd8c9ad756c162e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904318, "uuid": "c926739b-4a85-4024-b2ed-10e115a3b766", "comment": "Malware payload (Prometei)", "value": "58d0015c5c34117fe510e842ce68b02d2360be9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904318, "uuid": "e1be9704-19c8-46cf-8750-a4d382f43398", "comment": "Malware payload (Prometei)", "value": "dd9beb5ef2f9f9658d8b77a2ec960a857210e351d98995ab2a65e94f2a7edc9a1cf92ba1441a5f33069514392a595e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904318, "uuid": "20602f7e-49cd-4982-aac4-7720ae3c0e91", "value": "T1129423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904318, "uuid": "6defdd39-5afe-457a-99d7-c75c407c77a5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg9:25WOSACZSV6eKRH5EPiamb4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904318, "uuid": "e34ac93a-593d-484b-af47-ecdd8a8f5c03", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904318, "uuid": "0e1b0594-716e-49cc-bc42-0bfa471142fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904318, "uuid": "a4a4d293-8f3e-4e3c-abea-717a2b414ac3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641822d8-12fc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743953566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953566, "uuid": "dc16dd78-b5d4-4a46-9e96-d430599bef3c", "comment": "Malware payload (Prometei)", "value": "6ea7807c04bd555b070734af088e63dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953566, "uuid": "9abaaa75-c20a-4ef2-b684-86851de0fe9d", "comment": "Malware payload (Prometei)", "value": "3b1659d88a2d7b502444b3d3d5117ffb9cae5dc868567e8623594677c5ed07f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953566, "uuid": "f4718601-0086-42f6-8b63-080734b281c4", "comment": "Malware payload (Prometei)", "value": "b760621bfe554440448aebea19dbceb0e0f92d1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953566, "uuid": "2cc274f7-7a19-4653-8ca8-e1ca1bf90655", "comment": "Malware payload (Prometei)", "value": "b6a950f2f1fea5b8d72e5a8dcb55ffa70c0bb4cecca1210b0235c472e1a271f7de7a3a553bac6df8eb4d41f9b9d36537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953566, "uuid": "cf615657-91db-475b-91f3-e399ca471d15", "value": "T18F9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953566, "uuid": "7e3251c4-eb29-4192-8f41-6bbd93b677f0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743953566, "uuid": "01aab2e0-ceb1-4895-ab2a-4ded1433b18a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743953566, "uuid": "0828d10b-4adc-424b-9609-f9c87a5deda8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953566, "uuid": "25669055-2f78-488d-8d1e-e55a04df8fc6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ace589f-12f9-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1743952262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743952262, "uuid": "7f03e9a0-a017-444f-91e5-af5f5e91cbc1", "comment": "Malware payload (XWorm)", "value": "659a2885380e53f39d58601bdcc72e02", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743952262, "uuid": "6fe43fc3-81a3-449f-b70d-f2506f4c4970", "comment": "Malware payload (XWorm)", "value": "3b23ff9376bdfd645ea7b4525d2b250152e4d0a6674cb782095c1aa64ab63a71", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743952262, "uuid": "b1ea3330-a554-431a-a53b-ec3ea17f40bb", "comment": "Malware payload (XWorm)", "value": "33122d53a991f31665de2bcc634c15d2de23665f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743952262, "uuid": "e7ffe132-525b-46f5-8488-65be2cb2254c", "comment": "Malware payload (XWorm)", "value": "75baf2a52dafdedcf1b623ffb35fe8e37ee49b4f257a2565b8ba7342bc2091fb4e4c2ca7b9d571a02559a783bd8259de", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743952262, "uuid": "69840a24-7087-411f-9901-cd6094ab1b8b", "value": "T1FA143A103E5059F85BECDA4B484DDA1DD391470B9522ACBEF203EF206F696C941FE29E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743952262, "uuid": "93c604d2-0386-476e-b429-b901795cfb0f", "value": "3072:Adr69RrCyDkQMNdxYKBcDf/YMPialfSE+4YYt6AgXqYuUK7n272WL5Fh:7rCkpXDf/3ZHt6Agaxo5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743952262, "uuid": "ed061d60-f3a7-41ab-9b96-998b0bb9893a", "value": 200053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743952262, "uuid": "074476a3-166a-4441-be2c-820829811597", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743952262, "uuid": "a7781695-a2b0-40df-863d-1cbe08f3b100", "value": "thingy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c125308e-12ed-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743947280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947280, "uuid": "a61e9b39-94f3-4652-9310-651535a4dbe3", "comment": "Malware payload (SSHdKit)", "value": "14e26a8b2bfb3b3eddd3a5918dabe7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947280, "uuid": "da4c24aa-1a10-4ea8-bb41-673ec2ac7a20", "comment": "Malware payload (SSHdKit)", "value": "3b592dfe2d44c6adb432d80ffb787f2321f9096caabf4287039599b1a8fe7210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947280, "uuid": "52c8e509-4770-4ae2-b57d-0f3dc6fe801b", "comment": "Malware payload (SSHdKit)", "value": "5c5ecc8ea50673bf123f5a18f6125adb0979715a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743947280, "uuid": "a89a68be-da26-405c-98e9-e23d5b1f3759", "comment": "Malware payload (SSHdKit)", "value": "4b041864ae7b68f82251eb7688dd4f782effd46f7a3ddeda850fd79c35bc28ffb02c8e7d3f4b35ea82d25531cef4fa43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947280, "uuid": "c5516ec7-bec9-4b92-86c3-589daec21c97", "value": "T18E356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947280, "uuid": "0faccb09-2791-45eb-8e07-a4a6b8bb7f06", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxo5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO382TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743947280, "uuid": "0cdf6674-d8c8-45ab-9030-675adef9780d", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743947280, "uuid": "002babe5-9788-4fdf-8710-1c91d9e98131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743947280, "uuid": "6d039c24-fb83-4449-8ce5-d9ade7b57259", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8e4d91-12b3-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743922340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922340, "uuid": "b26783c0-34a3-4312-8ff6-e3ef80c502d0", "comment": "Malware payload", "value": "dcdfe4a5fca622e00c206245895f14c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922340, "uuid": "15780424-bde8-40a9-a9fd-3c606554bbd4", "comment": "Malware payload", "value": "3b7de09d48ff82ea1e92a3bdc478d34d48d749075abc2dd2470c99e320280171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922340, "uuid": "49bc5704-9f91-4b44-b7ce-6a22a5c4ba98", "comment": "Malware payload", "value": "67d47335ef590c436b5086eff18aa67258f1df8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922340, "uuid": "ed9c7593-8ffd-495a-be15-cdae03278ef0", "comment": "Malware payload", "value": "6b38efa8eade58a8e7491dea731a295fed697410bdd4baf56fe2d02ad426a4bee83f088751f26e1e85b7b5f5ca161690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922340, "uuid": "1b6bb320-229a-4ac2-a9a2-7f1e2654fbb1", "value": "T17EB3F899B8919F66C5D506BFFE1F828D33231BB8E3DA7103DD146B24378A91A0E6F441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922340, "uuid": "5288765e-9d11-4b86-8687-590a676aaea7", "value": "3072:oqE7CGICtpZ19kOcIk3UvNIpWG3nQEYulEQhfhNsdu:oqE7CGICtphRq3iIgEY0EQph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922340, "uuid": "5399bf44-73c2-41f0-b80e-01cb7b3e29e6", "value": 107588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922340, "uuid": "417f6e14-8c02-45b9-a810-57c732f7162f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922340, "uuid": "4ba75f92-0ee0-4d88-aad0-cf62f4707405", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b826c8-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918266, "uuid": "542ebe36-d064-4dc1-a617-36fc60286424", "comment": "Malware payload (LummaStealer)", "value": "b8884ec5bd57e5ad90ba601411ce0eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918266, "uuid": "18fae1bb-9615-4c89-a0da-554c88d236e1", "comment": "Malware payload (LummaStealer)", "value": "3ba74042eec73e89f3ae6382f8430f0f99d292c6ba9a21ce43558f62701960db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918266, "uuid": "a8833b03-80b1-4a5c-a82e-014bda0c1737", "comment": "Malware payload (LummaStealer)", "value": "c3befa393fa47491b19e0478d2a4e2ad2de52b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918266, "uuid": "655a0a8a-3472-46a9-bc00-5abe8697d8c4", "comment": "Malware payload (LummaStealer)", "value": "3928490dcfb394d6dabd74b9e5802c2ed41b8440ef9b5dcc1a096b62c15fd6a2f0f91b1916960e091ed40411fa6eda0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918266, "uuid": "b3bcf379-7c6b-4599-9434-9436cfcd4cd2", "value": "T138A512035BF25626F98D4A71F278350DCF8F988520E6B3342DB4A341D8C25CF96A967B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918266, "uuid": "79175c90-1985-4e16-a1fd-fd19285d6c98", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918266, "uuid": "5db828cf-11f4-4e6d-97d1-e4f9480d88e4", "value": "49152:LU+Tmg3Fu2743q5+f96zxqKyHLLrMvQixNKRYvT:LU+TCkzQl6zxyrLrMnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918266, "uuid": "8ae62d34-4e87-4783-a0ef-fb8cb801c637", "value": 2093056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918266, "uuid": "8e622bef-fd14-4398-a7ee-0ca0b00dd606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918266, "uuid": "f9b05a3f-c5c3-489d-ac5a-07228adf49e8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078c9661-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918192, "uuid": "24d2dc78-7100-4c55-bd80-d3e7068ce2ee", "comment": "Malware payload (LummaStealer)", "value": "abd85e0a81a985c638129a569bcb6de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918192, "uuid": "d0ec6daa-cf43-46e5-9a1b-2ba60bd6c985", "comment": "Malware payload (LummaStealer)", "value": "3c9dcf8048e75c25b02798b0e3199da87b0d3a62cea8348078ed34a6f89a28ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918192, "uuid": "b637870c-182d-431f-8ed9-bf433ead6e58", "comment": "Malware payload (LummaStealer)", "value": "7ea4c94da4f7c2fec4b6971a4bd96770855dbaac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918192, "uuid": "8e851b3c-5f6f-4e33-8f57-39557cba8125", "comment": "Malware payload (LummaStealer)", "value": "ef2827e138f2b42b1d32123c7f924acb7d9239c49035dee1f05892b17431e75a08a1ac098c9afe0f65ab12bd51ddea06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918192, "uuid": "03a9cdcb-8a7d-45fd-8813-a5b652d28915", "value": "T171A523E5AB4B3093C9B49E31943F0AB7552C70310E61891FA9F4DB777C8662901FEC6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918192, "uuid": "66a20955-22a5-4b0b-9fbb-1ddd8ab15696", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918192, "uuid": "bc1da718-77c9-4acb-bd85-6ba2bf3186dd", "value": "49152:VBiywkYTsHxeCVkT3Z02UwpyccnNfBDf+mk7us7nvGdnPMMz:WTNCyT3ehpcoTOSQOpMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918192, "uuid": "c6fbbec0-7de8-4202-b237-0c56716aa23b", "value": 2172928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918192, "uuid": "e57a4f19-1907-45f7-b69f-591bbcad40ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918192, "uuid": "87c6539a-0f0b-45a2-bf9c-b33bb219469e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c523f0a-12b5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743922952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922952, "uuid": "d3219bac-7009-4709-b228-20a974d608a0", "comment": "Malware payload (Prometei)", "value": "26e55bb692a9f540edbc74013c0bb41f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922952, "uuid": "52cb8146-90dd-4704-8500-e0d194d0141d", "comment": "Malware payload (Prometei)", "value": "3ca15255bf7102d521e215a8d3e5956e2bc3ca4351d102e693336f55754ff1e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922952, "uuid": "5bb1730c-a7d4-4187-a172-870d216952c5", "comment": "Malware payload (Prometei)", "value": "53ee12f51785fe1a7b48af67e61bae4eb87be265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922952, "uuid": "bf5be871-62e0-47a4-b542-1f7882e0cf57", "comment": "Malware payload (Prometei)", "value": "32c425c73a50bdd1123094bb763dac166c88b02f64d4cdcb217f132534280be83e87d6f1efa4363ff966460d2316b8ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922952, "uuid": "a38775a3-6e2f-4c04-9d6a-b34bd7d33998", "value": "T1DE9423F8C87D2E3098169B3CBB1A8268F0E15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922952, "uuid": "9bcfed19-d8d2-451b-87a1-83543f5bdf61", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgF:25WOSACZSV6eKRH5EPiamb4DsDwwc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922952, "uuid": "38e703c9-6bf2-4ea6-895a-69c013200668", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922952, "uuid": "cfa2286b-7b76-406e-ba8e-f22d38dd8d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922952, "uuid": "b4d4be18-fe9c-42d1-8d38-00fcfed71ad5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a87e0d6-1307-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743958355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743958355, "uuid": "e42fb6e4-db30-49f1-9b65-05fe9f147329", "comment": "Malware payload (Prometei)", "value": "496fd4d816be8d98fc80c7986d746ecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743958355, "uuid": "6256cfd4-479d-4cdd-9a38-2676d0bc672c", "comment": "Malware payload (Prometei)", "value": "3e7e483f19739bda2fd6fb6bfdbd10d82c6b5591ba28f538a10a95508cc09192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743958355, "uuid": "5cab33b8-4967-4947-a38d-56f13c3a1287", "comment": "Malware payload (Prometei)", "value": "715bf990f2371a7e3a26c93fc9de6d6b7ea1f4a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743958355, "uuid": "1eea5df9-dc06-447d-8250-e5a22e3d34fe", "comment": "Malware payload (Prometei)", "value": "5e13968fb9cf4a3aa4352d05b0fc1544f899e5dbd0f34d0a6e520495a7d94970e1d8f0017c4d2cb4509d65111cf02a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743958355, "uuid": "d396b26e-7275-4742-977d-e8f0cc33c268", "value": "T1099423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743958355, "uuid": "7d1a4f42-948b-4d5b-853e-7046952d087d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgji:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743958355, "uuid": "c5616ead-5853-47aa-8d8a-f7e51c98da8d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743958355, "uuid": "c16d0320-558c-45b8-990c-0682d103e097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743958355, "uuid": "191b03ae-f4c9-4ca8-8e94-22bfee24827f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78fe24b-12cc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743933144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933144, "uuid": "219cba8c-df19-4541-9800-c2868cbf16db", "comment": "Malware payload (Prometei)", "value": "69ed3b630e03064832ff6326a94f4859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933144, "uuid": "a88a7136-d24c-478d-9a8c-1cf5dceefb2a", "comment": "Malware payload (Prometei)", "value": "418504180cb990a254ac22b7d8217f9c30a71c7aeceaf4f6821161d6ac40a9c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933144, "uuid": "0ae79c8a-c7da-4d2a-a666-848e4acdca0f", "comment": "Malware payload (Prometei)", "value": "1bb7258d7f6c88df976d1ca5f20dadb94e1db8a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933144, "uuid": "a1111793-f64e-4eae-b3f6-455d9c8e1660", "comment": "Malware payload (Prometei)", "value": "3bfdf23d213115001fd197bdc17f90de594091d0512e41896d6fc613d55795573a58a88e14c43ae20aabc082158e2973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933144, "uuid": "45808d1d-bbab-4cc7-963b-f0a51505176a", "value": "T16C9423F8C87D2E3098169F3CBB1A8268F0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933144, "uuid": "2fda3d9a-2c80-442b-9fa5-7fb429c444d5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743933144, "uuid": "eac622f3-20b7-4d47-b683-671b0a7d0965", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743933144, "uuid": "25e80170-1716-40f8-adbc-d733bfc49f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933144, "uuid": "c8b3a578-4559-4dcc-9409-1c53c6677bba", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ac62f8-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1743939154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939154, "uuid": "5bf58ef0-89e5-4544-bee2-ac3b085d0436", "comment": "Malware payload (QuasarRAT)", "value": "2f0f5fb7efce1c965ff89e19a9625d60", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939154, "uuid": "64b7f20a-8914-43de-a644-8a9047237186", "comment": "Malware payload (QuasarRAT)", "value": "426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939154, "uuid": "333602cb-f089-4c1a-bf33-715d88ea17b7", "comment": "Malware payload (QuasarRAT)", "value": "622ff9fe44be78dc07f92160d1341abb8d251ca6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939154, "uuid": "e43faa6b-4338-4ccc-b62e-1b49ec8e5ed1", "comment": "Malware payload (QuasarRAT)", "value": "ad41b172c88822a43f52355bd58259c1586793e078ec777386ac9051d94d951645fbca10c4193e0239b8ef1c7eac03db", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939154, "uuid": "3606ef5e-2252-48c4-8d59-ec149f33c3b0", "value": "T19D65227DC7FD7DA80B6D318C5A6F37092A9D4F83A43A87ACF3F60845141790699A30AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939154, "uuid": "0979b813-66f8-4875-bbae-90ffd9653244", "value": "24576:CNaT+MFqLxtragXMnhUFiXoY/+u9Vnl1yyOc85U0XPIhb7u4HNYqUjSqK:u4GEeOnlgpgFXtDN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939154, "uuid": "acd4ba1d-593f-4817-87fa-b7a2a6884754", "value": 1434216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939154, "uuid": "aebd9158-3bc3-4ba6-bce3-c5d82750f528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939154, "uuid": "9716aca6-e1ba-43d3-baed-09ebc7eeec57", "value": "ccosvAs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f6ee35-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918272, "uuid": "6da5f724-b6f3-453f-9c99-d1eb6ec093cf", "comment": "Malware payload (Amadey)", "value": "db506068bea05039755819f6264f1637", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918272, "uuid": "c04fb7e3-7cca-4609-8f79-3916092cdba5", "comment": "Malware payload (Amadey)", "value": "42df3ff92307b39a8672b637f424b1b8fb604ffa739d87a2b543698b9c336910", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918272, "uuid": "766096da-5a9f-4b37-89ed-ff67efb5caf8", "comment": "Malware payload (Amadey)", "value": "fb03917365bc49831d7c1adb248e99960fbacd29", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918272, "uuid": "c910bd58-3b43-417d-9b54-09a81bda287b", "comment": "Malware payload (Amadey)", "value": "beaf18cf74ace8c13b833b53acf74aee86b6ecc3b72d6053ec7a602798df44295724e07ac42f7795fe47ae516b19c923", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918272, "uuid": "6ad159ba-cbc1-4e8d-81e8-d1a9e42e126f", "value": "T1559533850C37B5F3C06872B2248DF25378F854C6EEF97B1B884ABE68851B59311DB968", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918272, "uuid": "a8624bff-ee80-47a8-87bc-749906b7ff98", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918272, "uuid": "0fc15298-035d-4ac5-ad8d-1d6782366729", "value": "49152:V3PJ8awqbYkC1fBo6p6O3m0AXqix6SzkWMR9Q:V3PJacC15dsLXx6wrMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918272, "uuid": "4fb8b824-c6e3-4674-bff2-38370f5b0d9a", "value": 1884672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918272, "uuid": "303892f7-89d3-40b3-84d1-4aff326335ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918272, "uuid": "bf3bbe6d-a907-4c35-928d-e3aed78b8dea", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93c17dc-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918168, "uuid": "c378b0e6-1f04-4b20-83da-6bc696eeb3b6", "comment": "Malware payload (LummaStealer)", "value": "e1415cc57389eb2fb1911ec722dbfee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918168, "uuid": "ec95693b-e4d4-4770-b0ab-8d3e3770fcef", "comment": "Malware payload (LummaStealer)", "value": "43ab98057f4cf3ccc6ff334cab11ea77384caf554a23541e3bad0b3758b04277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918168, "uuid": "da067573-8c75-46c3-b55a-6c451e854c62", "comment": "Malware payload (LummaStealer)", "value": "556d3460307d5d6100799d0b7dcaaa976b4830f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918168, "uuid": "ce46e7a9-4dc3-4444-8299-7afcbfe3c9d0", "comment": "Malware payload (LummaStealer)", "value": "fa0e59e80b2689ea28a8b2fbc13b518aa7fb520dece37d1e23c9e989efcd28ee8623e660bb693a872bf5509faab031f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918168, "uuid": "f803e87c-85db-43a1-86fa-35e4e186b46d", "value": "T116A5121DB45B78DFED8EC633D492481FD26C80AA32398099B3A8F41C5D346B56D3692E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918168, "uuid": "be70febd-7ec9-4fbd-a1b5-9c47bfbcce54", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918168, "uuid": "b41a50aa-f9c0-420e-848d-5ab491057a6a", "value": "49152:VPKsvxmNdy/qib8TrcE0NVioyI0xkVq/bWQY165GNrY:VPK+c+C/Trc1yIBVkKQYlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918168, "uuid": "ae6fec5d-d18c-4162-bf83-2cf7f1a6f961", "value": 2094080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918168, "uuid": "f080f369-e681-4fb3-8daa-a57c0d3f0da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918168, "uuid": "f944e0ff-e4b7-4796-85d2-de95b1267139", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c38e9c5-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1743918200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918200, "uuid": "71fd8eb5-560a-4d78-9fdc-af0163223d44", "comment": "Malware payload (AsyncRAT)", "value": "2c45788c08d96965bc39341b76753e2c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918200, "uuid": "c92c2b23-4874-48ae-8c08-8733b6d5047d", "comment": "Malware payload (AsyncRAT)", "value": "440c3df99e39d7adbbd231ab92b01c2e70e276703e8b5831822bba1facc7e1b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918200, "uuid": "642e8d85-9dda-482b-ae2b-77cb764af474", "comment": "Malware payload (AsyncRAT)", "value": "aec47d530910271c13724303a30aea8a3efd0bbd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918200, "uuid": "ad59d855-bbbe-405a-b57c-3d0f9162c39b", "comment": "Malware payload (AsyncRAT)", "value": "bbba3d618f0ad176cf6e4deedf0e54ff6184f86e2d6e7d12d3b68f571c84b426fd961a188abc30210cf7558b4208da02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918200, "uuid": "694abdf0-395a-4714-a3eb-53c02b2da938", "value": "T104B49E60F75A9EC6D44E8E31DAFEB6B8F629786859449313B38C72124DA120CDCCC7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918200, "uuid": "8f9ef041-3b63-4ff1-bf7c-f4eb54b51d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918200, "uuid": "17f5295d-2d48-46a2-9f83-e7e9635289d7", "value": "6144:pgtRLlWNy6QhId2Ae4KRrPbylpPP+UNtcw41lhkXV6VxTUm7J1:pSLla7pXKwp3+UNt6nQCxTUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918200, "uuid": "c5c8745c-83bb-4747-a32e-9add6e3865b8", "value": 502176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918200, "uuid": "eeca9150-e42a-460d-8019-5c374df46fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918200, "uuid": "cf51926e-7cb7-4572-91aa-c7a0aa3cd3fb", "value": "j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57244365-1281-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743900717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900717, "uuid": "7725b26c-d083-4500-8952-9c4c9852e889", "comment": "Malware payload (Mirai)", "value": "fac9506c384f101b26c2aecd78f31c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900717, "uuid": "a26f63c0-6813-408a-b4d2-186aabd4fd86", "comment": "Malware payload (Mirai)", "value": "44f8f1f60d166b659edb5ccd194a4d9164ae273649cb51887132a2100e832595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900717, "uuid": "0bc3a5cd-ae25-453f-b8ee-4310c549de04", "comment": "Malware payload (Mirai)", "value": "0275532fc9d2faf8cf1a0f15db86f5043b8b19d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900717, "uuid": "d9116bc4-637a-4e75-90a7-cfd281b78d68", "comment": "Malware payload (Mirai)", "value": "6aaaab6319eddd2966d1afd25bad37a4d038bcc054e1900a57fa12ae12d0d9c3243ba3cc1f5e4bd3ce573d93d6ad875d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900717, "uuid": "729ce546-ea45-4ab5-95f5-76cdc26de256", "value": "T15EA30959B8918A57C6C646BFFE1F828C733653E8E2DB7203DD14AF2136CA5270A2F145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900717, "uuid": "0496762c-9536-40a8-8193-2215b73c2b44", "value": "3072:stpm+GE0jcpzdXH26Pc2A9hRvN7H8Sj1tev/MYOFrikcFEGd/:stA+3mczdXWHVmSavEZNcFEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900717, "uuid": "2c4a200a-d6f6-494a-a0cc-d102d02bfedf", "value": 99528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900717, "uuid": "1313e205-dc82-46d3-ba1f-5f3d01b9bdb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900717, "uuid": "b0dc7c05-23e5-4012-93bf-2d576763e9fb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f789ad-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918166, "uuid": "69431aa5-1d5a-474f-b351-a0c93c822ff2", "comment": "Malware payload", "value": "6179ba1849c31ef0caaa2f9b6550627c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918166, "uuid": "f5d1d546-8727-4e02-b8d7-2ed88e875fa8", "comment": "Malware payload", "value": "4568714a9b828319cded33cdae3dc0c19590a6984929dc66c0559f3331dd22b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918166, "uuid": "d507f332-71ea-4af8-a0bb-cc0e339aa127", "comment": "Malware payload", "value": "68ebbf0e85a651fe47830a99d02b3a988e1a4c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918166, "uuid": "4c7d31f7-4270-4e34-a669-a0b18bc5723e", "comment": "Malware payload", "value": "b97a918e57922940b4aaf1ed2b5f74c19a152bd4d0aa746dc2ebad76ae81888764f5902b0ae422ee044c27b1b8daa413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918166, "uuid": "d6955883-a336-4c5b-a810-1d8b91f56e02", "value": "T1DB76335172A008EAE037427A88678625CB737CB0131A825B57E4D777BF533E3AD7EA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918166, "uuid": "c8ca3c58-e0fe-427b-9f02-5d87a5ce680d", "value": "d170e2e5adcfc4c271f2eb78a565305e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918166, "uuid": "9ed6e79a-51fd-4c95-8ca1-d22a0ef2a7c3", "value": "196608:uzy4Edk0FpymvdsCncs4njQthsiHzy7k7C7DZRdwKihxy:p4DwBvaCncNnKhs57IC7vqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918166, "uuid": "56d8f4f4-889c-41ff-ab3e-ff90aa9842a5", "value": 7552298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918166, "uuid": "55558611-4510-4b5b-b075-558a2f2e2148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918166, "uuid": "846cac96-b85c-4dde-8b93-c77f14be463c", "value": "cryptography_module_windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce9b506-1310-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743962252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962252, "uuid": "f1998f47-58ba-4e45-a067-019d72c37400", "comment": "Malware payload (Prometei)", "value": "bab74d95904d4c58a0bb09df1d47ad48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962252, "uuid": "c5254002-0d3c-46d9-8e21-e425bc3c9c5d", "comment": "Malware payload (Prometei)", "value": "4705cc16c207a58d981b541a27d6d2af2f5323e6f1ca670b166d4c474dbae253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962252, "uuid": "5cf80ca6-9333-4351-84cd-8dac66d359d7", "comment": "Malware payload (Prometei)", "value": "816a3c58694d569320e0c95c877df53dd77a17d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962252, "uuid": "23e82c76-6994-46c4-b968-14a037f99731", "comment": "Malware payload (Prometei)", "value": "da7b07fe357a55c6cc5584bd200461455279c289623575bd5923e2b5ccd5a1aac6f128610079cf6cac88d430380d3127", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962252, "uuid": "934ff43d-c413-4836-bf88-ca60837da8e7", "value": "T12D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962252, "uuid": "b083da35-fa54-4b15-a638-bce0141a90ca", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplf:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743962252, "uuid": "1c8e9dce-6c16-4adc-85eb-d5f96ae5fae5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743962252, "uuid": "b3a3a0c7-4a1e-4c19-919d-ab55430f9a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962252, "uuid": "50a90a67-94e2-41a3-8f71-83c8c5fb98bd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ede5bfd-1328-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743972455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972455, "uuid": "63575463-942d-492b-8933-3a2584054751", "comment": "Malware payload (Mirai)", "value": "ccab5efa595517769048efac496100c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GorillaBot", "colour": "#DC4C2D", "exportable": true, "hide_tag": false }, { "name": "GorillaBotnet", "colour": "#8F75EC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972455, "uuid": "e87b4c4d-4335-4404-a59e-44d8bbf80fe6", "comment": "Malware payload (Mirai)", "value": "47c13ef0abb0670eb988b356dee62f01de5eadcb4aecb56309704a060d0c363f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GorillaBot", "colour": "#DC4C2D", "exportable": true, "hide_tag": false }, { "name": "GorillaBotnet", "colour": "#8F75EC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972455, "uuid": "20338883-a7c0-4bdb-b773-92dd083ee2cb", "comment": "Malware payload (Mirai)", "value": "bc8cf6cb8a09a0e16b2c04b71b6d432c3d283f22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GorillaBot", "colour": "#DC4C2D", "exportable": true, "hide_tag": false }, { "name": "GorillaBotnet", "colour": "#8F75EC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972455, "uuid": "3573c790-3380-41f4-a790-d4ae5201dcd7", "comment": "Malware payload (Mirai)", "value": "590be54c8ea16d9459878590721fcba9c33112f892c0f101e2447e14e29e612d2e8a6509aab940a6c7f1ffb82afb6ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GorillaBot", "colour": "#DC4C2D", "exportable": true, "hide_tag": false }, { "name": "GorillaBotnet", "colour": "#8F75EC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972455, "uuid": "9686d061-22ea-4679-8e9d-a7c927f63bb8", "value": "T133B33B45FC929B61C2C11ABEF91E128E332317B8E3DF72228E245B70678795B0E7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972455, "uuid": "1a23bca1-7ecb-4724-812e-3e2cbc5b91d0", "value": "1536:j7nIt3shHMYWxcPQOPNM4+ImJJ/U8aRClFZRKdPiZjap9Pv5eGJ3xYsd:s8hdoINatJ//aRKpjap9XTBLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743972455, "uuid": "85c9ab98-559c-4952-a3a1-f7e4498afdcc", "value": 112348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743972455, "uuid": "cade0e5c-443e-4a9a-88a3-88d94aea8372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972455, "uuid": "df928b14-24f6-4ca9-b098-4f95de31b229", "value": "arm6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c590a99f-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917652, "uuid": "fcda7926-710c-4271-a1e7-6ba90e806f9f", "comment": "Malware payload", "value": "c5401c4ca0427402a7f62273f379656d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917652, "uuid": "a8d7894f-14cc-465b-9dcf-93789014e99e", "comment": "Malware payload", "value": "4835067c53099783dcb6ecd5223d9cb52ff1074a4fed0e3426d415944c1e0ce2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917652, "uuid": "f2364191-3c6c-4ed2-87b2-d75a140dc8e7", "comment": "Malware payload", "value": "0d51de083ed92371891c14e67be4a4090ebfd0c2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917652, "uuid": "30a5738b-ee51-481e-9767-701998564cf7", "comment": "Malware payload", "value": "8db00e74b23f4f78c9b9d8a810d200f160adeefe0a6651cdc2fd6c5c0d4d1b7e066277edd3e8f71a125046f9739b8d3f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917652, "uuid": "a52cce8d-749c-4dfb-8f63-d0bc5b855ed9", "value": "T1FDF0499B48072274CA6869E876ED43444D5E90C8771E8AED7536E0C2281EDBF98AA439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917652, "uuid": "5855513a-881e-4b86-90f3-b0866320c287", "value": "12:wor62fr77br469XNHS6zgj1a6/98JGfFomI98wYuQj68WKz96+CWW6LtCU7uuIOW:womQr77brNB5U9z9omKYhuRKzw+CWbpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917652, "uuid": "3b3ea0a9-bc29-4c99-b8cb-66f3c413c7ec", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917652, "uuid": "de76f01a-5444-4680-8208-87349909a286", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917652, "uuid": "02dea38f-3957-482e-a536-810ee109368a", "value": "downloader.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c0bf55-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935289, "uuid": "1a14da89-7283-4401-a64f-ba8a5fe3a329", "comment": "Malware payload (Mirai)", "value": "e3b62664a9af2c2cf6f86e6f9b5e994f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935289, "uuid": "bd02eaa2-e346-4075-aa2f-fe38763fe946", "comment": "Malware payload (Mirai)", "value": "4929c41f8b4195c77a06dde3a112da387aa4585ffc1cebcf815603e17007969e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935289, "uuid": "1fda8ab6-a39a-44af-a4d9-822e09626637", "comment": "Malware payload (Mirai)", "value": "b90abc81a3c191640119fe15905d28febf1e763b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935289, "uuid": "387f887d-14c4-415e-8051-a97f2b0750c7", "comment": "Malware payload (Mirai)", "value": "cb6bec8897d18f7237138cde8ed6da2670c84cc3a576d8ce9f4966782e3f754f087e14cb0656bff7015946d6719b8923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935289, "uuid": "03064127-9797-41ef-a348-203f43365191", "value": "T10723F1E052135902C6E52933E9F21744BB2B7FFED1AFB48A422D825C29E8D4051BE9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935289, "uuid": "dea0c2b8-59b8-425b-afe9-18e29ae4ff8f", "value": "768:4eqExYaNb/a5CoE3hPPuVNvw+r/NyqZAnFFViulp39q3UELPtd+iFzYdLxjI6Clu:4ef2aN7DPPPGNrQXnFFViulpGLFdu85o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935289, "uuid": "489ee65a-0327-4298-8356-88c79ed03b29", "value": 46912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935289, "uuid": "3a4e2210-f312-4f1c-a7dd-64a9a1610399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935289, "uuid": "1dc4f490-0a20-49c7-a581-edfbffd71a7d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefaacbb-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918044, "uuid": "31b47eac-c175-4fdd-b12b-df701e09f141", "comment": "Malware payload (LummaStealer)", "value": "0814638020be76b94d3cbf9c5866a876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918044, "uuid": "376e1c9f-7318-41f0-9a0c-0eca0cdf298c", "comment": "Malware payload (LummaStealer)", "value": "4a71577c7f521eb13b2ef0106a777f9b7c25c80866e1f4f992cd1d639cfd07ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918044, "uuid": "3793e25c-e831-4927-92f1-9e23a2d5c077", "comment": "Malware payload (LummaStealer)", "value": "779d3801c0f914603f5bc2730565fc319bbdcb4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918044, "uuid": "8b0c94ed-8a0f-488f-95a1-1a1b73ccdb5a", "comment": "Malware payload (LummaStealer)", "value": "7900810552dc92de8efedc0911e78489b6e935a112c5284a91463d5eb50c616e7b931c53b3007ccb49b45b1959dc38e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918044, "uuid": "17509ecd-b2a8-49dd-ac6e-5609d2a711fa", "value": "T191A51260E4AE8616D54B61BE4819F3D449F77D71C2CED2E74A2BF3B3928E1717C88224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918044, "uuid": "bffcace1-09b6-4f92-a742-b02eb50d84ee", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918044, "uuid": "1406a6fe-0d8f-4437-b4e5-572b9c3e24ee", "value": "49152:qCvtNxGxdAq9nhMc2DWVI7zwOqwYy0180WmOk8LGc7kN:Gr9uX0IswYy6JOkmGIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918044, "uuid": "14e48afe-0736-4474-95c9-ab28dcb1c1a7", "value": 2103808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918044, "uuid": "af24a51a-9698-492b-8f55-d88342c9cd3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918044, "uuid": "a62bbe9c-abdc-4402-a5d2-07ab72b3fbc7", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6fe3e3-12b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743922043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922043, "uuid": "ea984629-d4cc-4f11-9f0f-3652f587c73c", "comment": "Malware payload (Prometei)", "value": "4b7824d2fa02e303380f308de5074da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922043, "uuid": "79819bcc-acbd-4afe-9c34-e417976a8cf4", "comment": "Malware payload (Prometei)", "value": "4b5470000f116841f296fac7041eb77029cda129463f39289eeeb259adf64b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922043, "uuid": "2643bca0-a949-4a99-87d6-eb74a0e19fc6", "comment": "Malware payload (Prometei)", "value": "1612a55a6c3ca776f311c2c807d73dab8872341f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922043, "uuid": "47f4c5ee-7d4a-47aa-8d8d-ee91e5b10fad", "comment": "Malware payload (Prometei)", "value": "2776eb1b6825870d99754c6c329f34abb62d42a96dc3ee4c170e5f7f6504cc86d1c80e8eeb860b8f74bd631cfc98fcdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922043, "uuid": "f1769565-6b21-475e-af8f-5dd6285bcc51", "value": "T1A19423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922043, "uuid": "63c06a43-1f97-4524-979b-86c1b58a372f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgfy:25WOSACZSV6eKRH5EPiamb4DsDwwcPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922043, "uuid": "9a64607c-33cb-4b3a-b18c-d6edbc689c57", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922043, "uuid": "0f27c7fd-648e-4444-99d3-cdb13b8eed84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922043, "uuid": "fb9fc082-7c7d-474c-8198-dcfb2e5bad96", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac640e5b-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918039, "uuid": "6eee2221-0b65-4d0b-84b9-dfff4b8f2092", "comment": "Malware payload (LummaStealer)", "value": "27824098b8b9ffc116222ffe1f18da34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918039, "uuid": "2d957a1b-f814-4fd5-aa46-20e55b4b6b67", "comment": "Malware payload (LummaStealer)", "value": "4b898b760f3548fde6c9baffba7a1d70b264adb2da73452088a607fdc7c4a539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918039, "uuid": "563b1148-3b40-443b-8dbf-b1931346b44c", "comment": "Malware payload (LummaStealer)", "value": "2215a2084c09e8db399db744d62a72bca4e20756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918039, "uuid": "15ae7552-56ca-4c58-8bf5-252f479bc127", "comment": "Malware payload (LummaStealer)", "value": "848c38097b8f4e7d617707a89102ebd14b3cbd274bebb943aa62075b0bf1eda67e6ef990261c9bc84d5a172340ef344f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918039, "uuid": "d1545a07-c4b1-4c01-b331-db1ad5bdcb11", "value": "T149853300B7D7D679D7E9E2F17175C0A23A2E7A07A5A6CEDC6C0C0B91A4DF27841BD122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918039, "uuid": "810798e1-5406-4a7f-b11d-4812d9eb8128", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918039, "uuid": "71410f04-daf0-435a-9b06-6338adbc5b30", "value": "49152:5kx+2HywsjDBKilBZC+gbylFRPxjLDhfk1hEUKM:R8yjDBxlBiylHNLDdgCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918039, "uuid": "257c3090-f3a8-4ae4-9f28-4f004efc94cd", "value": 1858560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918039, "uuid": "4131c27a-722b-486b-8096-2e838960d42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918039, "uuid": "db89678a-3a02-475a-8ed3-6f3215debc23", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5a71e8-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743917612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917612, "uuid": "bd68ef75-71f3-40f6-8d96-d8b61f8284db", "comment": "Malware payload (Amadey)", "value": "1d3884fed22b097a506674cbe12c00e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917612, "uuid": "71ea8d46-a369-490c-8c7b-e9b0ddba6c85", "comment": "Malware payload (Amadey)", "value": "4ba91382095cc48ae0b28ef91df1382800074d6082150639e7b0869d08440428", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917612, "uuid": "c1b565cb-626f-457f-958a-14e39e025378", "comment": "Malware payload (Amadey)", "value": "0757833894d336897ea0a98ad2c3f4144a312e8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917612, "uuid": "f0435aa9-02b4-407a-bf07-3075bddb0cb8", "comment": "Malware payload (Amadey)", "value": "6aa95c44923910cf7721247925f9c5111ec0b463218ff86f393ce08d69bec100e4c1348c4c6cb12c1bcd833cba16d4fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917612, "uuid": "7532128d-5620-492c-9d11-d0fba5f155e8", "value": "T173953340B1ABEDE8FFD85A718C8CF35D57A151A1D66EC4AC8EF23772C603B2C6891458", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917612, "uuid": "1204df97-3c17-42cd-bc08-1708d94c2a28", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917612, "uuid": "eed3df9a-a1eb-4231-affe-604a6ce77e49", "value": "49152:aAfBbzoG7/UE+hy7zKyWhjhWVt6M8WH33Oy9pPZRu3qbdE:a0bf7Z+hy7zKyW9huZ8KOyzZR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917612, "uuid": "5bc6bdc6-bd33-49f8-b26c-b8253168b30f", "value": 1919488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917612, "uuid": "8d9a9cda-ccbf-4b31-a287-b53b5603bb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917612, "uuid": "98af68a0-d0ff-4424-ba96-8cf3ad3801b4", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fba11d-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920638, "uuid": "bf9b1448-4dc5-4123-b5df-7d94d8251a74", "comment": "Malware payload (LummaStealer)", "value": "0844f4fd919eea970710abe6fa82e5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920638, "uuid": "793b9f5b-5fac-4d6d-8b63-728b523b72ea", "comment": "Malware payload (LummaStealer)", "value": "4bff16fc52a48e9e3f8b900afe86b51eaf363b14092f44590d5473aa6bcf8949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920638, "uuid": "ef43ccf8-8f88-43f8-b16a-d24e96bab780", "comment": "Malware payload (LummaStealer)", "value": "a47b4c49262dc258c26220843f7936df9e664a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920638, "uuid": "24aaa09d-1a2b-4a9a-979b-d3f42a37c8d2", "comment": "Malware payload (LummaStealer)", "value": "78d8efe826b3dac61b64d9de6427b8348fd7635d33d8835a0ede3ca7be53c286b274e066ccb52f3ce0dd3e1b79bdea5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920638, "uuid": "9dea56de-955c-4f69-9a62-c8720c913a4f", "value": "T136553302DFE01ACDC6F4D171F36EEE26798ACAFAD51B05550AED777D2448236012EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920638, "uuid": "7588b18e-8003-4ed0-bacb-9b0a543b108d", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920638, "uuid": "f837dd20-7f2e-4c49-b2c6-f868a04d3107", "value": "24576:3fofeKwF8DSInNzgRfr5spwOc7fMZUf9e1LkhbbVM1sE9NMV:vofIuLnh6sST7fM71L71X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920638, "uuid": "6aad063c-64e1-4894-997a-2537b3869b47", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920638, "uuid": "d355246a-89a4-43e9-99f5-b50f1c0c5d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920638, "uuid": "54590732-c9a7-4b4c-bfb9-b720db5a3d16", "value": "SecuriteInfo.com.Win32.Evo-gen.4550.7337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef0bc9-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918005, "uuid": "08a5c66e-06bc-4bd0-9305-64ad4819ad77", "comment": "Malware payload", "value": "fa4ebdfd9be526846a0c6d9a7effc5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918005, "uuid": "6caa2deb-e145-44df-8ef1-b3e52b1a3ba0", "comment": "Malware payload", "value": "4c7a99c94a152522d1f2ae4fc197fa01826dadb0ce886abc4bbb28a0785ee148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918005, "uuid": "6f5c6f58-ff5f-498b-abe3-2bcae6f4e783", "comment": "Malware payload", "value": "538a3f63d371a486859c71b5ef0b81f3d0cec986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918005, "uuid": "b3583255-2282-4412-8ac8-8ab417034b75", "comment": "Malware payload", "value": "9c8c5991b4c0da7998bc0732a391446816f86966e91d4ff644d97ec6ebd0b2c8c4f44f838866226726c3fe2f9ccb102e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918005, "uuid": "ba30ddce-2e55-4e13-a8d8-1e7709942d4c", "value": "T1FDC5E121E3A9A831D2B36A3ECCF773774D2D7D512824B8176AE815580738B90BB35376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918005, "uuid": "4a0ce362-62ae-4a01-92fe-5bc0311c3b41", "value": "09461e896df904e3166547e3aded33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918005, "uuid": "8e2ec391-9ecf-4cbf-a1b1-930d684e2a31", "value": "49152:ifNtX0ZuT9/0j/TPs6jHAmtz73eHOLF+PqG2zZpSHpYs:if7X0ZueTTPs6deIF+iHtcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918005, "uuid": "fea70108-cf41-4841-820a-2b73c2e37ba8", "value": 2571475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918005, "uuid": "c24e7b19-8470-4fd1-86d0-8952e11aee7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918005, "uuid": "cd048005-0eb9-42b1-803b-0f8c04eefa45", "value": "needmoney.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774bf56c-127a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743897764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743897764, "uuid": "878f37cc-c7f2-4572-80e2-6322fb85599b", "comment": "Malware payload (Prometei)", "value": "21af909fbba87d8c3862432d1be17b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743897764, "uuid": "68039d96-bb66-4dbe-9778-51303fda8420", "comment": "Malware payload (Prometei)", "value": "4ca680b5b15707a4871efc00b7f67c9c0ffef0cdccd2c26cddbbc8e50872854f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743897764, "uuid": "4db8279a-0a84-480d-82fe-9465da2757af", "comment": "Malware payload (Prometei)", "value": "d49aa100e18d06d75ff24d3e27a482e909c17025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743897764, "uuid": "457241b2-ff49-4b26-b1c4-ba9451a7e781", "comment": "Malware payload (Prometei)", "value": "7c2ac5fa5e13b1a70ea3d44c431406dd0b79bbeab006ec9bc8318641f34f945e1e5749c784fb37b59b2ae01ccaa7add8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743897764, "uuid": "8698df02-181f-44e7-a2ef-ba09fb21e8ec", "value": "T18E155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743897764, "uuid": "b8e247f0-a0e9-474f-addb-921e979ce78c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplo:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743897764, "uuid": "6ac92bc0-1f41-4c1c-ac0f-0059d95c0ad5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743897764, "uuid": "f770e74b-4a27-4d63-a81e-a020532dcc20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743897764, "uuid": "d72f88f8-9ab8-4cf1-aa34-42304296d2cc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd325b8-1336-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743978735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978735, "uuid": "1cd228c0-28e8-4b51-8f2d-7e1bd33b36d0", "comment": "Malware payload (Mirai)", "value": "4edab8658613cc0a98ed0b85cc89998f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978735, "uuid": "06d22b0c-8309-4de1-a7d9-5023c8350bb5", "comment": "Malware payload (Mirai)", "value": "4dd8246df7fb9f30e74d55c909b642b7c3ee24ecb97f6605177ed8ca156004b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978735, "uuid": "ab95b885-d9db-4d18-99da-90cb744cf5de", "comment": "Malware payload (Mirai)", "value": "972b65abe2c4cbdd8f34164ecc59816bbd70dae6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978735, "uuid": "2823b4eb-6dda-4a4a-a754-9ff6d69d31eb", "comment": "Malware payload (Mirai)", "value": "b2e25e6debc683bc936aeae50f90dec08508e09b9ef377b66c6b9ebf2dd79900cfa19ebdaf267a352b954558c4f78f34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978735, "uuid": "a8686e1f-8ea8-4bc1-a43c-68707043ffe5", "value": "T19782D031738575F2E7F00438E9BE81AA72680FFDD1AA33A20512293CCDE509DB2D5587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978735, "uuid": "c6880862-39c1-49d3-b2a0-b70eb1f5ac28", "value": "384:rEKzJ2ycgX2VF8l4sdV4dRE/Bxp9V9aUQ8BlzUTbnthymdGUop5h4E:dd2TgGVF8lEda9VUUQ8BpSRs3Uoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978735, "uuid": "39923c8d-b666-4da8-86a6-db2e4c9881c0", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978735, "uuid": "2f87c5d5-5b3f-4612-a7a8-3785a9e70648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978735, "uuid": "10485abb-277f-4069-9431-206af8a54dc1", "value": "parm5-20250406-2232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b97e706-129c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743912428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912428, "uuid": "5c28bad6-606c-4298-9dba-be3950cf7cfd", "comment": "Malware payload (Prometei)", "value": "97ba060798716eedfa68262324b3c7c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912428, "uuid": "9341815d-5ab4-4508-bcc5-0c120b8f458f", "comment": "Malware payload (Prometei)", "value": "4deaf91f8f5838f8d3ed4bd057bc3e932b1a4f303b0a312533fd358689625ea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912428, "uuid": "d2aac5ff-1196-4968-9711-c34e44eb68a8", "comment": "Malware payload (Prometei)", "value": "9708e25c92d5c1391d770c9edcf6c8f4c1ca2c63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912428, "uuid": "42fce140-e85e-4116-a0af-8f4a9fc7c26b", "comment": "Malware payload (Prometei)", "value": "a0c2d61eb8a53640d22148a41adc5a37a95032115283ec8ee939c0e95ce9c492e5a2a248a4a9c5e7d19a5a510ce30b93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912428, "uuid": "33005c9f-7fad-4432-9c21-9377b819e256", "value": "T14F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912428, "uuid": "0bd54473-2692-4b70-b43b-21b75d5381ba", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mply:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912428, "uuid": "5c3b1523-aca4-4785-8622-ece5b7cd6c1e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912428, "uuid": "5c4857c4-a589-458a-a9c4-ce6e42345f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912428, "uuid": "3eadc1a1-d037-49e2-b5fb-b2ddc00e5bba", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeb48c5-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934064, "uuid": "41e6bdc7-c3dd-48fb-83d8-5ad7bfcc9b64", "comment": "Malware payload", "value": "a248c675985050ada88a3dcf8068b85c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934064, "uuid": "353eb538-91bf-45eb-a929-ff553ce7e9ca", "comment": "Malware payload", "value": "4e97f16b5303fac20f7414a5bec150e9183eeb9f15707722cf644011a6fdd976", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934064, "uuid": "273575bf-1357-4523-bb8a-1237728d13fd", "comment": "Malware payload", "value": "17c5d2a49c30f7ddf1ded3e8609e5c4fadd55f20", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934064, "uuid": "855d21ad-7eac-4b88-bf76-a436f5ddb8b9", "comment": "Malware payload", "value": "5fd5483ca9598d63510cc534be841c49814a40aad84c8a49499492b42409764cf55c4be3b390c253f9890a13037f24ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934064, "uuid": "e3a34bbf-7ccf-4d3f-8516-e22536a62298", "value": "T1DF01A1F834512366090D9D5C9077DAC7F023D0E506328F0868DD3178CAA8D51F119D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934064, "uuid": "675f83c1-3e9c-4bb8-8bad-bb213fe99cc6", "value": "12:oOmKpLFmKnNIl53mKs0LKamKJ/emKXNmaXJNmZCemJLmkVXRFmUhXJLKK:oRKB8KnNI7WKPKVKJ/BKXEgEIBwch8cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934064, "uuid": "d1e9f2c4-9d11-47e7-bd68-2222ea56bac9", "value": 755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934064, "uuid": "9d0d063b-140d-4a15-b4f0-2d1f7944d11f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934064, "uuid": "d8c1a9b9-0e94-4c67-88f5-d8b532201d64", "value": "uuu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1acaf7f-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915444, "uuid": "ca37218b-e669-4044-b6b1-dbb5f095295f", "comment": "Malware payload (Mirai)", "value": "5a1988df54a33149672316ac1ec20d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915444, "uuid": "e39cc661-d697-4dca-9c73-bc52c249c80a", "comment": "Malware payload (Mirai)", "value": "4f671106d50c9661ba5dca9a455df965c9d9d6cf420a5c7e2e80806316de3d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915444, "uuid": "12e1aa59-a26e-4afc-9730-5ef8d54da117", "comment": "Malware payload (Mirai)", "value": "ca5e283383bb6c77d618602693fec6d536373899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915444, "uuid": "448c5d4d-4bad-47b3-a967-c17a0040e2a8", "comment": "Malware payload (Mirai)", "value": "73bf2c2d7e94a79f8f9e9718d63dd292fea74e5194f068ba8865796bd26c140ec6c68eb2ee717b2267c00b013d9412a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915444, "uuid": "9dcc13ce-849c-4c16-87df-ac8ae90a17ff", "value": "T18543851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915444, "uuid": "252eb0b9-f1aa-463f-9faa-f0796e829e81", "value": "768:bvaLxUxyQpPT5rhmurrFtSmSnoh2Lt3ug+31IZi0e4fyMnup//dujgtyw6z:bvJFP1PtkF+31t0lk16gtLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915444, "uuid": "5c11e082-70bb-44ce-8954-9a2fe92fe440", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915444, "uuid": "71b81add-5d99-4470-bc8f-419bf4da074d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915444, "uuid": "3ffb184c-ca0c-47ee-a27f-8b3bfccb7717", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94a3da5-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912129, "uuid": "67a3170f-ab4b-41df-9826-c4c925a18ecb", "comment": "Malware payload (Mirai)", "value": "ff1e8c848e83f91cbc0dab2f3f26b951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912129, "uuid": "15969239-8e1d-48eb-b690-53efbd735988", "comment": "Malware payload (Mirai)", "value": "50112e751740be8c5b937ae7681f7c49e233fa6b240f878a7ca2ed0c06d6b017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912129, "uuid": "d50036e6-16c6-40c0-b06a-8ae9aec257d2", "comment": "Malware payload (Mirai)", "value": "0ccef8ffd3dc402934849d51c8c144e2f6f7870b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912129, "uuid": "684ce578-12cf-4f20-8a41-7b01b4671bdf", "comment": "Malware payload (Mirai)", "value": "006a10244a53926d43ce23edd0ceab06d5e86f415562866521b8790bb103c39e32babb89c0a1e5ddd5e1d28edb02ec36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912129, "uuid": "5ad13363-5fa7-4a0a-82e8-95e1bcfe7381", "value": "T1C9D308DBF900E9BAF80EE73748130806B130B7A645924A377257753FED3E1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912129, "uuid": "28ac2cf9-ae27-4551-af99-dee2119c5a49", "value": "3072:E5ZCK8N9EzLIBVe/GH/d09r7XVvjbibLCQAkmyHyHlNo:EyJBVe/u/Ur72LG4HyHjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912129, "uuid": "cd6cf3c7-4d00-4757-9fc5-2998b453aab8", "value": 141504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912129, "uuid": "8176aa2c-0f6f-4d29-9b22-9ea636d9fb47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912129, "uuid": "17cb3a79-ac6d-46c6-8f9a-d1cc7d7fbca5", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783e9df3-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918381, "uuid": "dae3ee32-5469-4b3d-8e9e-46f84aa8818b", "comment": "Malware payload (Amadey)", "value": "6d59590bcc2cf8dc925d9edbf55a5001", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918381, "uuid": "30b277ca-c60d-4ec4-ac28-8facae5a371c", "comment": "Malware payload (Amadey)", "value": "52eca724693525d2df076c0af355f8945af9a77dcb0e9a644ede46eb02674eeb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918381, "uuid": "002ba0e7-c463-44b0-8e35-b7230b5925aa", "comment": "Malware payload (Amadey)", "value": "c615992b8ed47f13000c1253ca6c1e5cd8eacba9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918381, "uuid": "c0c88fab-ff0a-4703-9561-c2a740591948", "comment": "Malware payload (Amadey)", "value": "6779d349b67de48fbe63aeb805ea0e3f57e9bec98bb960149e7aea224663796ee25cb83b008d5055ca7a65945dd82406", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918381, "uuid": "8db2fbcf-30da-4e34-9da8-7804fd177051", "value": "T11856334BB09691B2F0F6DBB05CEB935B232D3C1C55AA496721EAEE44CDB2834573071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918381, "uuid": "dc1df53d-9eea-4c0e-9c4e-9c901288b4ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918381, "uuid": "4febf41e-3450-43b8-9087-9b425d392de1", "value": "196608:i+XP7VLihuEaC+oz4k6Kc2vnrClAZxQ9Qh9WJCWDiJm5z:i+/7VL4uy4kddvrClEQ9Qh0C/Jm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918381, "uuid": "4432efa8-9687-46ad-b9a1-1107afd7817b", "value": 6437888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918381, "uuid": "c3b6daaf-cc7b-4902-a026-d79d8c7fd60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918381, "uuid": "ff28013e-999f-4072-bcba-e8bceca1e43d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5f8b57-1289-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743904319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904319, "uuid": "4e66fd4d-ffa4-4b3c-a000-ec81eb2e0be2", "comment": "Malware payload (Prometei)", "value": "56addb444bdd28e683c38bf552695865", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904319, "uuid": "1e4054a7-0507-4398-82da-1a316e8aed50", "comment": "Malware payload (Prometei)", "value": "52ffe5cb311cea592bf8f0c91f5c64890e473560a924b71f93c1a83b8e81a79c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904319, "uuid": "caa168a5-321f-4c51-a301-298771b02e12", "comment": "Malware payload (Prometei)", "value": "48ebaef6e0545c4c56421d4856dff837dacba649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904319, "uuid": "1d51529c-540e-4031-b5d6-d71c9678ad5d", "comment": "Malware payload (Prometei)", "value": "3cd59c28969299d77dedc4a63a2405cf6ae74c5df7dc9935fa78e2dfd519d772b31d4a7e731d97b646dffef7adbce6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904319, "uuid": "3bc95fae-a28d-4092-b71c-f5013f573401", "value": "T1719423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904319, "uuid": "52ba9734-8298-4eee-a80c-2159e56e3f24", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904319, "uuid": "18d5db5a-9c26-4d7b-b5c9-84fecc8237ea", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904319, "uuid": "41096243-6452-4128-9a27-bb8e189c6ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904319, "uuid": "2adf9ca8-8c7f-4ea1-a66f-c3b78fcdc74f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2539a9aa-1284-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743901921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901921, "uuid": "21cbc6ef-142b-4ae7-84c9-3bafd87c3062", "comment": "Malware payload (Prometei)", "value": "3b863aca184424d57c5d75bec357f937", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901921, "uuid": "12a0e06c-9173-4d07-a199-861f20d59848", "comment": "Malware payload (Prometei)", "value": "53e4ae40f1743434bcea9e037e663bb35a508f21f7af5ccb8a6d9237a943efa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901921, "uuid": "f3a88693-24ee-49cf-b92e-b3083403c654", "comment": "Malware payload (Prometei)", "value": "0ab434a16517b4e4011c556f6484dc5551c775cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901921, "uuid": "7e6718df-1200-482c-aabb-fcbdbd93e8c3", "comment": "Malware payload (Prometei)", "value": "08f01939daddc6f0d8538527a793c2faaf3cde279decbd411ad124867ac8fafb8e86c7ff89919a3581b3d3e4c1c0d96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901921, "uuid": "8e0b78bf-4a21-4315-9db2-646fc0497a9c", "value": "T1A39423F8C83D2E3098169B3CBB1A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901921, "uuid": "91b82355-bd84-4570-9e77-6d1f8a8571d4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgt:25WOSACZSV6eKRH5EPiamb4DsDwwc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743901921, "uuid": "88e855b7-fab3-4902-a8ed-75c9147cd429", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743901921, "uuid": "fdf7166e-d2bc-4e75-8300-5abe5ea328c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901921, "uuid": "808b58ed-f9f1-4a18-bc2b-1e1a2c7c5246", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad67195-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1743939028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939028, "uuid": "5c8b8629-b230-40a5-8b7b-b61451c89e51", "comment": "Malware payload (GCleaner)", "value": "48dba44bc6b70e2746b05bb511baa73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939028, "uuid": "2180a377-e241-458f-8288-f074dd98d9c8", "comment": "Malware payload (GCleaner)", "value": "55130dc03d7c2cc1e434581cf4e5808a4612fe2908453bd5260207ca5403f410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939028, "uuid": "d8656634-8e66-4ed8-8c84-bb7459e9c5fe", "comment": "Malware payload (GCleaner)", "value": "e480206615a763f28e44823e2463ddfcb51b8c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939028, "uuid": "4afb8600-081a-45ea-b1f3-129b06b50dbd", "comment": "Malware payload (GCleaner)", "value": "003b76ded11766bc61b4008942ad8c2455ea32055a454db7cee9d6b69a51eb7ea046ec06028adf03b7d95336abf6812a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939028, "uuid": "aa7ba389-a58b-4cf3-806d-652db411bd28", "value": "T19E26339CFA561E12CEA58D3BA4C50E832FF441F0114E0F41E7054DBAF58B96A737BAA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939028, "uuid": "e94cb65d-547d-465c-bcb7-fa0c1bb0e67f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939028, "uuid": "65250595-9056-4d97-9b04-8e4824e1040f", "value": "98304:IH2JQkhkHkXXGtw7cQQ2DQTdcx6NHWsSgfuATYbJSCDBnVCcNbR4TSjT0:i2RKHqtQp2wuATYVkKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939028, "uuid": "3a3563d3-b8ea-4393-bf2f-358d1d077817", "value": 4808192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939028, "uuid": "814f81b3-d65b-4a51-a12d-34b37cbe0797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939028, "uuid": "22c3c3fe-cbf3-415e-a9cc-7f0c2c45806a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5001369-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935287, "uuid": "9728e0a5-fd52-438d-945c-3b7b67978e03", "comment": "Malware payload (Mirai)", "value": "dff27eee01f1f357ab55f04564d63325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935287, "uuid": "9025a070-4e01-4e6d-841a-a3cf138f7827", "comment": "Malware payload (Mirai)", "value": "55861bd397a0f548a90f57bc885af3f8b46b1698830a912cd03d0d0909d83251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935287, "uuid": "242144df-92de-4702-bf45-68842a39b04b", "comment": "Malware payload (Mirai)", "value": "e75cf613c780c1c8bae3b6b4e459670111f59658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935287, "uuid": "4c918564-e40d-4a91-96b7-d9a77d73635a", "comment": "Malware payload (Mirai)", "value": "ec015b47a80cb48cf173de902eaa57c86cbfd3a1acbfbefbeb6244f5d719fd7d5d3cb9d976e99d9474966ecc274e5d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935287, "uuid": "ab7a0458-2ce4-4ab6-8a3f-6e09d1e0d76e", "value": "T1D0338D36D01D9D94C9970134A0AC8F351F13F1C8A3536EBB1BE946B1A8479A8FA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935287, "uuid": "12e751c1-be6c-49a5-85bd-22d2810a1665", "value": "768:nauy8qjIN8eY1L8e9tbqyLr/FUBf2atuKLbbNgzgbb9TE7dg3oCIoLWBqhvw7CBb:nasahSkj2BfTQKnmzp7dOoEyso7CBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935287, "uuid": "acb16001-6238-4e8e-b5ea-3a043d735c9a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935287, "uuid": "5a533ff4-a29c-43f1-a438-968e00f3bec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935287, "uuid": "783cf9d1-2864-41e4-944b-a038ae46a3c1", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d1a2ef-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918022, "uuid": "2da7916f-cf3c-42e4-9000-d86ef7873d52", "comment": "Malware payload (LummaStealer)", "value": "648db666cdfce08aaf48df4941ee97c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918022, "uuid": "6fff119b-6918-493e-9088-ce0e8203618c", "comment": "Malware payload (LummaStealer)", "value": "55b860fabe1a78732a8da1705ee338ca940056bc2563c117646023d9798fd988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918022, "uuid": "0497c186-618d-4d46-ae2d-aea961239d3a", "comment": "Malware payload (LummaStealer)", "value": "70be8bd93732cf1b1f81c684686dac9783b4841f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918022, "uuid": "6c2c268c-b4c3-4307-a335-24b6cb14bc23", "comment": "Malware payload (LummaStealer)", "value": "ddd208841769cc34f29b3395129be3a0cf9fda71ee4df563365d4af4c1bc13c8f0ac1b5971cdf38af54ce03150c36bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918022, "uuid": "2c70e607-7968-4958-bdb6-e3f579061189", "value": "T1BC8533DB0E46F21CD2A97974D5AE172B9290AEF186D723802FDB83729C11B41F9C41B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918022, "uuid": "f72a1b5c-b606-4dc1-aa15-45d7fa3e59c6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918022, "uuid": "55918227-0cda-4b0f-82b5-308435c5aec5", "value": "49152:5GFM7KrL/xmumSFIRVG/gtGKHXG3P92BSEbJyIX:ucuuSFpk239Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918022, "uuid": "024a0569-ba3a-48de-8088-894bf417185f", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918022, "uuid": "a1c722c0-b53a-4693-b24a-16545824833c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918022, "uuid": "9ddb0606-3ac9-4021-a7f6-6c5bd2459731", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084c30ed-1290-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743907027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907027, "uuid": "3eddf744-4d04-4eaa-a06c-8836bf89dc38", "comment": "Malware payload (Prometei)", "value": "051409973d01681ddd6140a034776911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907027, "uuid": "6a76062b-2dd5-4311-94a3-40951ca1e89f", "comment": "Malware payload (Prometei)", "value": "56e2b20c4c5c26e40c94f9e256f059ca4d2fffb8ce74e62f082427c0eed14680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907027, "uuid": "e4a00fb6-9a25-40af-b4f4-a86c32776b1b", "comment": "Malware payload (Prometei)", "value": "9bb1accb80f53bff8c40be2989fdada90aefb17c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743907027, "uuid": "edac8570-cb0f-49a9-9cca-2e7e02d2a19e", "comment": "Malware payload (Prometei)", "value": "7ee28caf4c6107f91011d01aec5bec3ff0fbe060db31674d9b5a3d805ecba1a114dc454f3158b73601d7762ec4d1c166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907027, "uuid": "a80c442c-7387-4602-89fa-271804d9ff61", "value": "T13A9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907027, "uuid": "1edef64a-98cb-4d14-a4bc-7f1422672303", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743907027, "uuid": "494e5aec-b1ee-47c8-8d2c-dea11cd30ca3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743907027, "uuid": "77442ffe-d91f-4e53-9dea-52eda1b0e9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743907027, "uuid": "b0a202ed-b602-42e2-8ed2-1235aa85a403", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415f72b7-12b2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743921725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743921725, "uuid": "366b2930-990a-4eb4-b11a-c763c5ee7875", "comment": "Malware payload", "value": "58d712feba21b90e6742dcf3338ba3a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743921725, "uuid": "0292a305-8d43-4b60-8cb2-23337d670882", "comment": "Malware payload", "value": "56ef308400325a2a62ed21c02f155cead105c646f4730e47f206fbf6470405ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743921725, "uuid": "31e6b422-7d29-46ea-a70d-141afbce2f22", "comment": "Malware payload", "value": "c5995d1bca43740221b075d990837a55a09d2831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743921725, "uuid": "057e7738-cacb-499b-b7b7-c0873c9dfd2a", "comment": "Malware payload", "value": "d7dd47f3f3a39ece5b27a1b2413faf910290fffa1e2ea6b5d55585a34c186647c046b0baa5b10377c99c7e935a5788d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743921725, "uuid": "fb4c1097-9829-40d1-a49f-a9698ae99649", "value": "T1FC148586BF903EFFC85ECD3341A5CA0A119C991962D4BFB65A34E414B79B10E99C3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743921725, "uuid": "817862b0-5070-4b5f-9eb3-4270e2b1bfc1", "value": "1536:t6aOQz0GWudVFCazfbN+brKUYnDbDrimPwWhRJddpsElvtdTlnOvitpr:t6aOQ0GWW46nQWx5d5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743921725, "uuid": "ddf6ea75-5dae-422d-8e7c-3bf422c438ca", "value": 190840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743921725, "uuid": "93ffac3b-bc67-4361-8df5-ff8cf573f036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743921725, "uuid": "36e69c1c-33f1-435f-8210-c4b069f5302c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6720e885-1298-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743910622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910622, "uuid": "2bea1c08-4a73-403d-95e2-4430b9fb3747", "comment": "Malware payload (Mirai)", "value": "470b4abb0c44e9c70b6c3bf2c3302a47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910622, "uuid": "c084dda1-9b63-4b64-b359-d3abd5712a99", "comment": "Malware payload (Mirai)", "value": "57ca48e66bc489959a44bb8c05099e2aeccc9080a318405316ec49cee1de6e4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910622, "uuid": "55afb124-d1b4-4dc0-a0a3-7b4530654d94", "comment": "Malware payload (Mirai)", "value": "6f29b42ec8b9e1fc06adcf49df83c667bb6cfbb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910622, "uuid": "7bd13155-3115-46b1-834c-5c35b3090bf2", "comment": "Malware payload (Mirai)", "value": "f6259cc3a72bb55e264b514f0d7d1980a7fc7ca2be932f4c75e294d86bb1f91c16b8119f2c1017531039817dd599360e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910622, "uuid": "f02bac9b-7a58-42e1-8213-68c2f254f807", "value": "T178C34B36F607C1B3C4430A79024BAA9A5D31FE7B562A4D8EF3583DB4BB328C47511B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910622, "uuid": "151d1205-480a-4c64-807b-6607af293205", "value": "3072:EXY5gzI24XRFnDjmoRcQeFxfusim3Z4IhzD9oY4giAGaJpP:EXY5BDXR9Jc5Om3Z4qzD9oY4giAGaJpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743910622, "uuid": "8026ecd9-3aaa-4acd-88e4-53573fd71b25", "value": 127274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743910622, "uuid": "264bcb6b-5ad2-455a-8ccc-fb07f32857d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910622, "uuid": "6569ac8c-5526-4b17-92d8-e8057ea52140", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e69b36-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918315, "uuid": "38190e0a-05e9-4589-b430-5c783a0594cb", "comment": "Malware payload (Amadey)", "value": "0648029f0eb1caba6fe73371623519ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918315, "uuid": "11218c8e-ed51-4f15-b765-c716c1b97288", "comment": "Malware payload (Amadey)", "value": "5cf7751ea33057a39a353f34da5527940ef4a44a90262697b2ee7186b6d40749", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918315, "uuid": "8b415c61-e267-4dea-9a40-1e8c9ee128da", "comment": "Malware payload (Amadey)", "value": "7163dd0c176ae453bbb974c983d1915a67b1b30c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918315, "uuid": "27fdbdfb-947f-45ce-b482-144dc5ac7f24", "comment": "Malware payload (Amadey)", "value": "9ddb2940fc7785d963eff794e6b7edff9bfb75b3fbffeef49a05ee6bdeb80aa05ae5f4642e22dc03e22c040ace9f3d6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918315, "uuid": "6add7080-ad60-42a1-8c54-ba4808d76bfb", "value": "T1A1953322B0AB66F9C25A8A36CCEAB24B5D637C1787713E9C9637515194C77D23BC0323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918315, "uuid": "204dc587-d259-4372-ae99-65f40f848311", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918315, "uuid": "dd606357-daa2-4d1b-a50f-5a16e42a2716", "value": "49152:ufWVASkwgczDzXciEqrZkRHbddTxCE+tpTmpgCH/GJ/u:XAHTAzXzu7dFxepTKgCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918315, "uuid": "677d3bb2-c7cd-4413-9fb6-911826fbf0f5", "value": 1918976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918315, "uuid": "7ae4aaa7-08aa-4327-a862-5b1639aeafff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918315, "uuid": "5ff9cb52-8942-45a3-a202-e151aedc423f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b798a6-12c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743927771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927771, "uuid": "126517ad-3b4b-48c6-84bf-ef412ab221a8", "comment": "Malware payload (LummaStealer)", "value": "4f42e67b18ad32a4ae3662c1aa92534e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927771, "uuid": "d2732e46-8da0-4002-a126-9e226df46e5c", "comment": "Malware payload (LummaStealer)", "value": "5d037ef54456896a1d51f10a26fd044b8d43075c7793f0b48bea38e3bd5c4e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927771, "uuid": "564b48ae-6576-4839-a273-825d600b55e0", "comment": "Malware payload (LummaStealer)", "value": "f9293f44c606ed3d4d5860b68ea77ce04a0a8e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927771, "uuid": "92277397-a8f3-45b7-8d3c-3eff229b9274", "comment": "Malware payload (LummaStealer)", "value": "614ee4805a7f9ec91d03ef1e7092c4f0f5e915f72cf253f6698f7fc840ca978467a2cce9d876edb6e571a5c297ea7fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927771, "uuid": "6cf6fa33-a467-4b5a-a28c-372f986b3a2d", "value": "T1FA967B41FD8B58F5E9031A3141ABB36F6334AC059F35CBD7EB547A3AE877291183620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927771, "uuid": "ec82887e-54bb-46d0-83b4-7f51e09970a3", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927771, "uuid": "cfe4d376-0776-4e75-8557-7ec04dc7416e", "value": "98304:AiLcoZdhFETFnbsoesEO+DPA4M6rEmmVZJ1wlpzCC3/XOony3h4:HhYFnkJgbVz12pmCTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927771, "uuid": "5173438c-3a4f-4985-8526-e748b39d6e89", "value": 8770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927771, "uuid": "cc2380ca-be94-476c-9e35-7517ecc224e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927771, "uuid": "4da54ba4-5374-4634-8a66-91eb55aec7e7", "value": "SecuriteInfo.com.Trojan.005690671.4724.29007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9903d973-131e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743968258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968258, "uuid": "284cff28-b5db-4096-aba2-0e0b0d55e60c", "comment": "Malware payload (Prometei)", "value": "832e30ad079fbbc4ee29ceff2a7e3a44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968258, "uuid": "bc1fd20e-5e3a-4d6d-bdb2-3a51927acb51", "comment": "Malware payload (Prometei)", "value": "5dfc32eb932b5089769a65dc6be56225cc605af9e744645a60c8e0bc57c81fc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968258, "uuid": "b9acb24d-e21d-4e6a-8ba4-ffc1c12811ff", "comment": "Malware payload (Prometei)", "value": "7119c50225a55d5d0ac5d1ce80b0b32e2c0a5776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968258, "uuid": "9929b6fa-fbfb-47f7-b5a1-ca83398d444e", "comment": "Malware payload (Prometei)", "value": "1227126c18938dc4d26c395a84c14ec324e9bc3c23526d838b4fb9131e07dd7d349107adec42483cf6fa8fc17456c09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968258, "uuid": "f6d150fd-5927-4e28-894e-8e303e7adff2", "value": "T197155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968258, "uuid": "7ad0ea81-0461-4f2c-9325-b25182533e8f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl1:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743968258, "uuid": "7cbf6f6f-3b03-4981-82b8-356c68ae2e14", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743968258, "uuid": "74c0741a-9dbe-47fa-aec8-53f3b9c24da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968258, "uuid": "55aaa3c3-d2f8-4aa5-934d-85970d578d10", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049aab9d-1337-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743978746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978746, "uuid": "7354b3e1-95b0-495a-98d9-a1e86556c908", "comment": "Malware payload (Mirai)", "value": "100ef4b8f64e366d163638d37ca3c1bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978746, "uuid": "01960ab3-d640-4d5d-af64-cf231eb9baae", "comment": "Malware payload (Mirai)", "value": "5f458fac9ac51846bad0d9c1f575a29ebdfb883f93d043e8659fafb5da4d1dab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978746, "uuid": "b09f7fbb-f2bb-4785-baa5-05630eb61bbe", "comment": "Malware payload (Mirai)", "value": "cadd3a27cb075b17ce96788f169e729a67027c8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978746, "uuid": "56095c6a-2b5e-491c-acb4-54acc9462231", "comment": "Malware payload (Mirai)", "value": "3bb31bebe143407c56f4dfa7c7b54661799c12c688570b8d7051c6ac2fcb0543d1604162e7f7915588393d11c1e976d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978746, "uuid": "2b8d042f-1f7b-415b-b829-fce2797c515a", "value": "T187F2F23CAF6342C7F0B5587F0E8E476559CC9F7353426D00AA10E227EE63A685546B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978746, "uuid": "12702828-f3ee-46b3-8eb1-de60f3ae3fd1", "value": "768:ylWqYyhCtwQ3uohr8iudOZRX4WAWQshfJgGlzDpbuR1JQX:Jq+tw8fuIbGWNLVJueX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978746, "uuid": "2fd8dae9-9401-488c-b6c4-2d8f328763b1", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978746, "uuid": "dedd20e9-aaf1-402d-8d4c-b36176bb6768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978746, "uuid": "6cfb25c3-44a4-4712-8ff2-07c4953cb419", "value": "pmips-20250406-2232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076a681-12f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743950446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743950446, "uuid": "3761b287-279b-41fc-8327-a80bdc20ad75", "comment": "Malware payload", "value": "ceea741b872a3e96175e9a31828f2879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743950446, "uuid": "48fe61ec-4a8a-42cd-91d7-090125447c75", "comment": "Malware payload", "value": "5fab911cf4eadac225289cb6afd84bc38e8059bed97815f7f9eabf4f230e0203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743950446, "uuid": "92f38c89-93b9-4c67-8e39-20888d6b2ec7", "comment": "Malware payload", "value": "3c23e750e778968b179d524fd34fa47766c7e0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743950446, "uuid": "8eb053d3-3831-4d9d-a389-7ecd9a986bbf", "comment": "Malware payload", "value": "ff13bde44574ddfaaedd765290b370cadef9001baddacc85ecb23cdabc9b18c5bb6810f31b7fcfec4d555e885f513179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743950446, "uuid": "9a177b48-319c-4c02-a7cc-94a5a2b29a78", "value": "T1A7044888F656C45DD7580EB49C51C7B782637E91BF60D01B78CB7BBF297E30A040AA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743950446, "uuid": "1b306370-4ea5-4597-a557-49b2edba5462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743950446, "uuid": "541bd0ef-9594-4e5b-b2ee-351eb4f0c68b", "value": "3072:Mi1ozR1tCGSXuv/XLe+Sg5kGjCOTWjJUUBWenZi+kNYrxjR:ot12gSeCOqjJjD0+kN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743950446, "uuid": "8d9743f5-3f5d-477b-8666-0c19982678c2", "value": 187832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743950446, "uuid": "2b2f4540-49e5-48d2-860c-1aa9a729f76f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743950446, "uuid": "86b6e4e9-a5a5-441f-89f8-206c629bad7f", "value": "Port\u00e1l Dokumentum Azonos\u00edt\u00e1s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4714265-1280-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743900417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900417, "uuid": "31e308a7-ae72-4782-af52-29db9ff85926", "comment": "Malware payload (Prometei)", "value": "46957b6fa5e8888cc81584a03c3afa18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900417, "uuid": "47d70d91-e37c-483e-92bf-de05f4efc9d5", "comment": "Malware payload (Prometei)", "value": "5fd557fcbccfe33889846d9c4959d691093e90921a39c07f7322eb4c994b2868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900417, "uuid": "84c7fbdf-1d0d-451d-a3a0-10f82deb3b0d", "comment": "Malware payload (Prometei)", "value": "493ebe857117e0c3d494d20f6ce11ebc2d860f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900417, "uuid": "9c92f855-1360-4e6d-adea-228bf66917ac", "comment": "Malware payload (Prometei)", "value": "8d9fe380e62194f83fb3449b9b544c7bed9b17f78ddbc2beae5817e0a8df2fd334b7109c478e8f3cf28ad0e943fca25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900417, "uuid": "c73b5932-837a-48b7-94bf-616b821190b3", "value": "T1799423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900417, "uuid": "66fd55dd-8888-4544-bd42-c89b21bf65fc", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900417, "uuid": "b74a6bf2-b464-4ed8-9e43-16f6b21ef61e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900417, "uuid": "975c9623-3058-4b35-bc32-08cc71b42dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900417, "uuid": "b2b940c1-42f2-4c45-b80d-c32780ef5291", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3153e6-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743917989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917989, "uuid": "6241cb9a-b5c1-4cea-8dca-9827b6eae3cd", "comment": "Malware payload (Amadey)", "value": "307220c9ae89edd1fe6095403c4797bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917989, "uuid": "71b39321-ac36-445c-9878-f86a3266f924", "comment": "Malware payload (Amadey)", "value": "60104ac87fb1c115886219ed760499a95fc5d38d09b714258f2ef67d57497cbc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917989, "uuid": "74f039bf-5997-42c0-80d2-89dfd93c21fc", "comment": "Malware payload (Amadey)", "value": "4c1a42857984d7718e1d103a414822bb6821366b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917989, "uuid": "003dd703-2d02-48be-b7f3-f47d5b995b75", "comment": "Malware payload (Amadey)", "value": "2dbd84eccc572b68fe25b4a13d700e51de544e5ece7e450e12e23e14682fb860fbad346167877fd45a71ec2acb0d0888", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917989, "uuid": "7f9444bf-b584-4a46-93da-fedad00127b3", "value": "T1A8563393A6E64629C1B0CB716D7D078313FB7B682FB052A73659B8551832F18BB307B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917989, "uuid": "3dafe606-986c-4051-ae34-56d6d4db1c13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917989, "uuid": "99442166-0032-453d-9b6f-9a9be3a71a4e", "value": "98304:MxToOivYI3hFMfoxW29LIxJpVYgucN2UZNPoQW6uAIdsaow7Oxz1r+N0XN2:8spw9oxW4iJpVYX+rZNT7LXaoFxJHN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917989, "uuid": "a8a12a7e-a8a8-4422-94e0-6f59e4ea9937", "value": 6406656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917989, "uuid": "0828922a-73b1-4ff8-80d8-6d5943530392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917989, "uuid": "18eda10d-f260-48d2-9504-2729167f7f70", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40739a0-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934051, "uuid": "91c91869-6733-4bef-92f8-eb41b99640f5", "comment": "Malware payload", "value": "39b85f696afe1e06ebd67d8c1f6c71d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934051, "uuid": "e4b75f4c-e8db-424a-9208-22b3ddd91df8", "comment": "Malware payload", "value": "6141287a6f2019bd70f49460e6e353e2a66c680cef0a30cee46ca05c5d8bf402", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934051, "uuid": "3ee87ae6-026a-4876-bdcd-89ce62fd51f0", "comment": "Malware payload", "value": "c08a52ab71876f4bd8b14548190c6d7f098d8040", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934051, "uuid": "da3dc2e1-c93c-4b5f-8a2c-96345042c243", "comment": "Malware payload", "value": "a5e165641398672b39cb396383a1211c18b2341482b3f377fb6e03394a64cae011b13b7f3c959f77fb6a0a8598eaff3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934051, "uuid": "87160294-0ed4-4240-9660-7d056a3f5557", "value": "T1F701D4EBE5611B62014AEE1FB672D59E6050C1EB133B4BC4BCDC343ECAA8918F114E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934051, "uuid": "1492a9ce-3e0e-4c19-bbdc-483c4f3d76cb", "value": "12:EXssXJgAjKjrpLrXnNIl5oLGjs0LKF3bt9JZ8SS3Fd:EXsgJFjKjrBDnNI7DPKNbt9JKSuFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934051, "uuid": "d902fdb1-5bf4-4c3a-86cd-5eda5fd64028", "value": 721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934051, "uuid": "d7d6755f-3e1b-4b0a-bb3b-bd4979288e73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934051, "uuid": "772d5843-7ba9-4c09-9614-e8bb7eb4a819", "value": "boa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b385c0b-12b9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924641, "uuid": "fc608bcf-05a2-4af3-9941-45e44b09844d", "comment": "Malware payload", "value": "0b4c833f55e7f315c9f055bddb115f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924641, "uuid": "3de13c34-765f-43ae-862e-4aef0f551263", "comment": "Malware payload", "value": "614cdb0ed0b2307284ed1c7dbf76ce3b4d62a9a885ad4ab8632e097efacb90af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924641, "uuid": "012bf084-b2c0-4a4c-9895-a47f426601bf", "comment": "Malware payload", "value": "4ee3299e0ffef2f17b2a73360067e18199f2e2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924641, "uuid": "95a08936-86ad-42fb-bc42-a66ad3bc76d0", "comment": "Malware payload", "value": "f1255c5850209da2a279f77a8277a1b9961c5176bcb6ade4e1c757f8979cec6abf1481679aca88614928089cd2e6a43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924641, "uuid": "bbc03892-e7cf-428d-8ef9-afd116808cc1", "value": "T17F470211658B8C257B9B59BECCB7353BB00E487D6D8BA5FBCAFC222270D8021165D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924641, "uuid": "08685d69-6580-4fae-96b6-25aba6f1541b", "value": "39485d72459e756469309fe09e0a936d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924641, "uuid": "6029f34d-9f5d-4392-809d-7f7dc089f198", "value": "384:nthIzxubyXvdy8xifzg2xlpeNUfCL8e8CpnqB/ftBEYy9hWTAf/mXBarmLFHtD5y:nHReXvU8xco+fc8enpUVb8G8rmB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924641, "uuid": "ca057589-3800-4c5e-b155-0b7361e3d9c4", "value": 25198720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924641, "uuid": "9dae16c2-208e-41bc-a859-1a517e2bce6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924641, "uuid": "118baa25-5dd3-4bcb-92d4-02d7a29ebcba", "value": "SecuriteInfo.com.Win32.Rootkit-gen.15622.16588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0149adfb-12cf-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934073, "uuid": "eedffef7-0d08-4f8e-abd0-0fe756c37437", "comment": "Malware payload", "value": "dcbfd0346e57ddc9266e84b0df1d08e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934073, "uuid": "678f986d-6f80-4a86-ba88-387616db648d", "comment": "Malware payload", "value": "617a6a7f3ed488f11c492f0f07c7c95c17073c6e265c0f141bf220942978c182", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934073, "uuid": "1c7860bc-f125-41f2-bd9c-28865bca4384", "comment": "Malware payload", "value": "91340cabffe31656920c0c8a5c388d7630488dff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934073, "uuid": "0615adbc-191a-4856-a372-1e066eccc611", "comment": "Malware payload", "value": "cfcae6b5ca8b56ce492080b90939dc8f914874e429d54c825a9ee5bf0bd3c84f02de6523ef28f9ecc3fd682ac0650fa9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934073, "uuid": "819f2990-877b-45db-aac8-88c3f2c91097", "value": "T1AA1160D653A00746090FAE1E71B9D59AA4B881E623374B9CBCFC347F5A5C824F114E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934073, "uuid": "fdb5adc9-cbe2-4854-a530-e31a5a3723f5", "value": "12:/8KSPLGjsKLKCR5XnNIh5PUpzDRL+QAjiHARe/eHAR/XJAWZ9oHv+Xa/aZa0Fh:kKlnKCnNIfM9DpwjU/pJdZOHekX8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934073, "uuid": "32f71eab-e089-48c1-ab8f-52758e444317", "value": 1019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934073, "uuid": "14693743-5c30-45d2-b081-5060336e9e89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934073, "uuid": "4fe7a4d2-1126-4e08-bc60-2a42ac4f30f5", "value": "bi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1941e2-12a7-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917311, "uuid": "6e483183-a91c-4b77-ae9c-a14f9377fd1a", "comment": "Malware payload", "value": "866664b3ce72c7dad2ffc552282ddd7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917311, "uuid": "50142aed-540e-45e8-bd14-ae996961b95d", "comment": "Malware payload", "value": "630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917311, "uuid": "54eb32fb-9d77-42be-bcda-8a05be4ace04", "comment": "Malware payload", "value": "43404be154db8ee32dc7c59de01f015235e44de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917311, "uuid": "9a4c8bb3-65cd-4a01-ab70-d77203a6de6c", "comment": "Malware payload", "value": "aa6ee3d6d3454bd7c37fd254acb0fb363b8aad0cc49b816836171e7f0abaecaee273095d96962c56896de1f3e871ba25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917311, "uuid": "f41ada13-025d-4eff-8f87-5d50d0511282", "value": "T110E5334A3BDA983AC6017EB019C163A256B5E6354F6508C79B850F055EB13CB6F3E2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917311, "uuid": "4bb8e8bb-077e-49ef-a3a8-3fe322ed669c", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917311, "uuid": "5a47982d-7170-4a2d-803f-d79e09433cac", "value": "49152:245zNpImiqbwbkjta9rZqH/NIzbWI3oFrv8NMveH3uPBsH0jw5RO6LgTKp1J0D:2455pI2wbkjcqH/NIziprv8W8+5sH0jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917311, "uuid": "4dae3bf7-2618-4470-a320-47130f8a94e1", "value": 3096152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917311, "uuid": "c5e37cf6-3f8c-4dac-9e31-fbbd69dfef5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917311, "uuid": "9a22f9b7-a61a-41b1-b1e0-38583be94edd", "value": "866664b3ce72c7dad2ffc552282ddd7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa40262-128e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743906422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906422, "uuid": "dcdd8bcb-2593-4caa-8b20-11064846116e", "comment": "Malware payload (Prometei)", "value": "425a1c86fd0043dfcd6a36fa11cdc060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906422, "uuid": "8095ca31-3ed5-41f9-b7ea-dbce8657bc71", "comment": "Malware payload (Prometei)", "value": "6377f2989404ff64115a4ec7619874445b68418ec5bad40aa85291eda5bbc5c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906422, "uuid": "8549c76c-aa9e-4f14-b47c-32142edf83a4", "comment": "Malware payload (Prometei)", "value": "3865153beec2991c3f09471f52e8367f3b2ed0f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906422, "uuid": "4cc09363-bc9d-4b06-98a1-4eb52a915726", "comment": "Malware payload (Prometei)", "value": "9e05b3df5b6f283cadaf4c5e8320603e2fe5c977f687228b067afd66e11981802d9a5f426b938b82482ec4cb33d501cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906422, "uuid": "51d72598-ea4d-44b1-aa65-277559d419bb", "value": "T1CA9423F8C83D2E3098169B3CBB1A826CF0E15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906422, "uuid": "31fbc0d6-61c1-4afe-8e1e-a02f719b23c2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgw:25WOSACZSV6eKRH5EPiamb4DsDwwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743906422, "uuid": "3a813a87-dcf6-4d2f-80e8-0d05f171342a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743906422, "uuid": "e4c08af5-5c0f-42a7-bb1e-13a4798fe085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906422, "uuid": "d9532285-1bc4-427e-8ce1-2c8dbd36b107", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae456c8-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (CryptBot)", "timestamp": 1743918279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918279, "uuid": "75ed3917-a0d2-4a2f-8e5f-5560b2afb79c", "comment": "Malware payload (CryptBot)", "value": "219d6edecccef1945d984b0d60530759", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918279, "uuid": "847553bb-884d-4598-891f-e76cd02faa9f", "comment": "Malware payload (CryptBot)", "value": "63b673485b2f3e159c2dd1af6d9afa9cc27c85411fafef13deef04dbcef6bae7", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918279, "uuid": "7e790e0f-3ecf-4622-aee5-8a2f201ad921", "comment": "Malware payload (CryptBot)", "value": "034302623e232aeb468508901e2f99413f684473", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918279, "uuid": "03bd1557-b662-4789-9033-08828c559ad2", "comment": "Malware payload (CryptBot)", "value": "41070a0f685a7462a4fb3233c481da180fd1ba23ecffdac668bf85b8a7e2b084c0a6b686dc1509e9b3de385456c17deb", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918279, "uuid": "83efc7e4-3c16-40bf-a054-e020a7a4e47c", "value": "T1AA5608A5EE8751F9DAC309719016B73F6E30A7009834CAF6CED1DF30D6A1A12E91E65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918279, "uuid": "8a7fd786-28c5-4f25-818c-898346f19a59", "value": "49152:1kkXWhUWt5E6dbEhfdJjmB5GyErPbfYeNyMGYcSC3VWsS+Kejh3:1kpH5E6sfjqDGbrPbfLQvPT3B9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918279, "uuid": "ad12ff08-21f5-4325-a486-03052162bb68", "value": 6071667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918279, "uuid": "4d18fdeb-d2ec-43c4-983e-430a7649a3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918279, "uuid": "17e3acb9-7e4a-4202-8cd4-b62e1c18863d", "value": "3yh8gdte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da54b36-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915438, "uuid": "6230eba8-b857-4767-ba71-fc118d09e6a0", "comment": "Malware payload (Mirai)", "value": "be5ec51d59fe75617157143ce34e4e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915438, "uuid": "d0c27a6b-b0cb-47d1-8d28-e9ce455b1846", "comment": "Malware payload (Mirai)", "value": "644440915fba5295044bed6b85ff06f002959d2c74baaf7937c52291f9bf6105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915438, "uuid": "d2b7facf-833c-4326-9b57-a516a13c7eb1", "comment": "Malware payload (Mirai)", "value": "f87b914336c079e21d6ddcfe1e164585bb27afd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915438, "uuid": "b75d198a-5050-45dc-b91c-8cf9740b0179", "comment": "Malware payload (Mirai)", "value": "1d6a8971d67d277745dc235704b6b5549f56703afae1374cfb4cdcb0aa1c1fae6610ae33135130c9509afc3001091bd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915438, "uuid": "bac1f3fb-14ff-4f4c-8e41-7b7a3fb82455", "value": "T19C23E807F54381FDC09AC274066BB93EAC2275FE1238F2B67BD4A7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915438, "uuid": "81d37681-91f1-4a7d-9403-f926f6cb33ad", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjikQ5jvI04Wx2fEj1s5KhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBFUIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915438, "uuid": "7138e5f6-b44f-439a-aea0-cfa3cfe9a2dd", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915438, "uuid": "fe6d8428-6700-4078-87bc-ab89cfc9b7ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915438, "uuid": "705788c8-4a63-427d-b971-d3d48de23e44", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff1fdce-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1743918072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918072, "uuid": "84612517-2d49-4a50-acb6-297fb9762283", "comment": "Malware payload (GCleaner)", "value": "cb04d30c4a93888c65291d036499de89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918072, "uuid": "a0863220-ac5f-4481-b2c9-ffecf19114d3", "comment": "Malware payload (GCleaner)", "value": "64f08caee40b30f2a692181d99a36d9458317a8bfb35bb12a95f60d4dc596f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918072, "uuid": "d31e3b45-5232-4ad9-a436-fa111e8e60ba", "comment": "Malware payload (GCleaner)", "value": "d687415ca74c0ca4f20945a860c87c143cc4bdbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918072, "uuid": "aaaf571f-7c32-47cd-aca9-44e6f53bc397", "comment": "Malware payload (GCleaner)", "value": "08f78e942012f572d8f556607fca64689b2b9b30cab6c9d77109e82ab080fafecb3ac4848fb57b16e8bb38447c7b0203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918072, "uuid": "c2daac17-ca30-46e2-9114-b649333951ec", "value": "T119263362AE5F845CC6494BBC492A82E41FDC7F31DDA95F0B36A50E34D58B3702B7603A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918072, "uuid": "4779143b-5568-4e6b-bbc7-5042a79b86f6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918072, "uuid": "0c39f910-b422-4ef1-88f6-39452aa01a24", "value": "98304:x/PvttkE12ZP3fQ8ki7FmjW65khukAFWac8V07VZUTJb:tvIEEZA8k3WE4zA8az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918072, "uuid": "b6cf81db-d8bc-4354-a21e-a2dbc25f1eb9", "value": 4567040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918072, "uuid": "a57505ac-0794-4abd-a04a-db4b48d44b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918072, "uuid": "699b20c1-0cfe-4315-a531-d0803f515dfe", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b02372d-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743928748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928748, "uuid": "76478446-412f-4baf-99cd-a75ada6b25e6", "comment": "Malware payload (LummaStealer)", "value": "4be2eb8946c8efd4fcf31c662a91fafa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928748, "uuid": "79fb8ac8-b8e3-4c95-8464-98ae08443114", "comment": "Malware payload (LummaStealer)", "value": "652f1c890566dec2fef9fd2b444a28d1cc367d954a71b2bb8b5c0702fed6dc04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928748, "uuid": "82a979bf-a05b-4054-891f-5a8445097ad8", "comment": "Malware payload (LummaStealer)", "value": "b25b928cd4e5f090613bda67a9a40ae18c57db3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928748, "uuid": "65a29151-c996-40f5-84d8-6226dd246b0e", "comment": "Malware payload (LummaStealer)", "value": "d3d17dad6fda89942c7f5f81995c5fa882c67ae314fd3e94e1d1db8b777d96fe96f6d2ed3674ef5a3c3ab260a5664021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928748, "uuid": "762966ca-47fc-4d07-aa37-2e1d93ec7b16", "value": "T1069533122BA18545D7D2C97893FEA60DED1F2F105DAF2F22E1EAF6D08131B0A59D0C67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928748, "uuid": "c81a5b31-05c7-4935-b5f9-54a74004cdf8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928748, "uuid": "c245948e-c9aa-4419-b491-4206aede663e", "value": "49152:ALb1FKyOuX9/iKX4TDMuCbGUdD3QGlWVWFI5:sgy3X9E8uCbhdD3nl6P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928748, "uuid": "89bd99dc-7233-4db6-8673-a975931c8303", "value": 1908224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928748, "uuid": "360d3306-6ebc-4b31-b0b6-c3de69fa737e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928748, "uuid": "6484ff4a-8123-431a-b83a-69c7623707a8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19130203-1340-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743982646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982646, "uuid": "573b94b3-c750-442c-a480-46aeaccac96c", "comment": "Malware payload (SSHdKit)", "value": "f02eb8a52efc7e5f594873f9230d8fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982646, "uuid": "5b4b1036-dc04-41c1-9584-5b6c01a259b8", "comment": "Malware payload (SSHdKit)", "value": "665ec2ffcb803ec1cffd2c8327796a336430e11be97766803f279ad208fd6ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982646, "uuid": "ef86b184-2fae-49f8-b39a-68e751081678", "comment": "Malware payload (SSHdKit)", "value": "95e98f71d163106ef822eda315e90475d79c049f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982646, "uuid": "93ea6939-a3f0-4161-8507-fa946a0d43e9", "comment": "Malware payload (SSHdKit)", "value": "40cfeb9566f8d0031eddff4f1e846c9ba9ffd64148fc685a70702d5ffc87eac3babd64a32233d872de1a57810555f08a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982646, "uuid": "45f261fe-5957-4782-aa3c-87605ed01f1a", "value": "T171356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982646, "uuid": "6051a7e8-c868-4262-9fae-181cf69b175a", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvz:00BnRED/TwOjX0a5xTdvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743982646, "uuid": "ed57fe3a-d9e4-44a9-9106-a1f04b6fc0bd", "value": 1109035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743982646, "uuid": "33988d09-f590-43f2-9870-708e4413f6c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982646, "uuid": "d8a6c99e-d2c8-431b-9dba-54bf768f6e14", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee233b19-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924592, "uuid": "13287ff3-4d2c-4f8b-ab20-9236cc1fe264", "comment": "Malware payload", "value": "4194ba809c07479d0b6c3681d218661b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924592, "uuid": "3ad808b2-2484-4470-a2e5-f2c256f8917d", "comment": "Malware payload", "value": "666e5e939aca03a8c323fc257063430fbab202f6ae1c4bf8c04fe62c75dade4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924592, "uuid": "aad3799d-cc0c-4c87-979c-0cb95974a30a", "comment": "Malware payload", "value": "2e8c858633dd5d519d8a7231150ddbc24fef2675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924592, "uuid": "93ee90c3-33c5-4c33-9d1b-b937628c4867", "comment": "Malware payload", "value": "1abbb6a2933979dc480c270d18584f35adb872bfcfb0e774833a9d8b8c0857009c95927c9f54f1af95ac1b5d14cd33d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924592, "uuid": "aecdefad-2670-42d2-8bae-d1bd029d508e", "value": "T13E4722443EDE5816FBDB9933407F3DA6702F405C558FB22B89D96216B4F103A0AFD1AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924592, "uuid": "63dc6bac-b451-43b9-bd5b-012095bafb64", "value": "75a7edd5e27e3873db683bbba6fe50dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924592, "uuid": "1ef01f71-5417-40e6-aff0-d09709a9d0c9", "value": "768:Epynh7s4ofEwaGHxAL/IoqATi+N1YMv47DUQYUbv8HU2LsNNkm9QIPwAHS:Epyh7FofEwjMI1ATiAP4RYUfKmlPRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924592, "uuid": "bd17e9a2-72e8-4f75-b60f-ad1f95ace3dd", "value": 25208853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924592, "uuid": "ab1e8023-99a3-4e5f-b39a-a0e3b8b96f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924592, "uuid": "98a7a368-3484-450d-a776-bed44eba8a3c", "value": "SecuriteInfo.com.BackDoor.Darkshell.246.151.16384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7455e00d-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743938991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938991, "uuid": "2b3e414a-d089-44a4-b661-d321423bec21", "comment": "Malware payload (LummaStealer)", "value": "4801010bcd02886812dd9f8f3d0ab3b8", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938991, "uuid": "ae864533-63e8-4b2f-9e85-cb270919146c", "comment": "Malware payload (LummaStealer)", "value": "6981dff0d4b221df64b60f6a66331d20a19c10a654ae13670a4c77550c7f2fe0", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938991, "uuid": "5f5c37aa-508b-42ba-b2a8-f3920e257113", "comment": "Malware payload (LummaStealer)", "value": "3b655ef3d3ad38dc1121878848340ef11e55fecc", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938991, "uuid": "ce6f60ac-0359-45e6-bd63-a8419e9de30c", "comment": "Malware payload (LummaStealer)", "value": "5cc7df86ce07f089ac636bb0a1a52122d8f80b6b2f9fccf7be6249ad8cf976496e2626026fcf969c748a964de5740de5", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938991, "uuid": "36508650-fefb-44bb-b6a1-00e80d9f56a1", "value": "T1AC3533F36D48AAD2EC310D3066959D25BEA5ADC427F0E0DE02B0AB2D4D74AC27BDD750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938991, "uuid": "ced1b91a-d6d1-40fb-833a-31cd46c50988", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938991, "uuid": "e50d904c-a0a4-4cad-90df-a07b09141363", "value": "24576:MtCnXJbSL9557jzrtZ3vk4MQx9ZLwaVgU4wROOWnJB0SO:M4bG9557jzL84MSLgUZREJ2SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938991, "uuid": "a5714538-3b8d-4575-85a8-647bb7b5daf8", "value": 1150397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938991, "uuid": "a7eb6502-a646-4f8b-828e-f899e5550f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938991, "uuid": "65cf776e-9a51-4a32-99d6-844947efb74e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8012abbc-129a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911523, "uuid": "e0d74a5d-9b7e-4608-808d-b33680253a63", "comment": "Malware payload (Mirai)", "value": "13cf9280f645e77333550ce5fc7ea3ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911523, "uuid": "829702fb-c661-495e-abcf-4de1a42a287e", "comment": "Malware payload (Mirai)", "value": "6984aed5d4c1ab9eae81ec3d5b5bd36e132736502ade424bb3ef6911bcb45246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911523, "uuid": "229a60d6-21f8-4c6e-aa65-9cf9cd9daef7", "comment": "Malware payload (Mirai)", "value": "3cfa9344ac43bf777ad4370a1f2a24a7bcbea6eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911523, "uuid": "a8e26bc1-103a-41e7-8cc1-d9f66732a9f1", "comment": "Malware payload (Mirai)", "value": "fd0d996dcde1e5e16749f3467abc38880ef3082547649ddad803a2d75cc4fea91f0589e4f0da840e96a67f0c08cff28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911523, "uuid": "b646b75f-1fda-4f10-a8af-c509e8858100", "value": "T1FB33F27F8E1ADD31C70048BA991AEF845A8BCFFEC5E894F61638523C586B820D7F5146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911523, "uuid": "da44119f-1b34-4bd0-9136-c1b406ac944e", "value": "768:uAlVea53fs5tmuOQbVzH95IytuxRavLSmiDV0E/hATBIVip9ZS/X/KHgi++Z29qn:uy8a53f3gzd5IyIb35/hATaV8a6Tx1LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911523, "uuid": "1c667542-7eec-45af-9a19-c3a69c8d7822", "value": 52192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911523, "uuid": "39cd06a3-1df9-4498-a910-2b2771891f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911523, "uuid": "490c0189-a6e3-46d5-9b76-457a71f86809", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f3aa9d-132b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743973655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973655, "uuid": "5f8f72b1-c3f2-4354-918d-ea768cbd8ed8", "comment": "Malware payload (Prometei)", "value": "8e81a22ef2a7788f81004b7a1d0f4cf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973655, "uuid": "43ed5759-e818-4150-b52a-edefd57356f6", "comment": "Malware payload (Prometei)", "value": "698ec76f0ce00fb52cf7d2a8bc951de5cabcc44c788938cf3042d0f5eb68c6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973655, "uuid": "bce3618a-4caf-4f4b-9715-165a75104494", "comment": "Malware payload (Prometei)", "value": "98d37c4dd448f5e985fb0e7db9756bdf531e1e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973655, "uuid": "26109857-ac8a-4f79-8d21-4a7ca4a4ab11", "comment": "Malware payload (Prometei)", "value": "960f5bfd763413f8ee87be0522d21346aaf437b0cd90775560959550f6dc06356d2405d7c74f9ddefe61ed888b92a20f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973655, "uuid": "35c4c7ac-ab3c-434d-ac43-cd850b36d318", "value": "T15B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973655, "uuid": "8fca107d-80b5-4cd9-aa1b-51b2807a62e9", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl4:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743973655, "uuid": "dc213a44-df16-45fb-a0a2-4ff5376675c7", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743973655, "uuid": "b1bc0bdb-c0c8-4902-b787-4d3e9b8f5ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973655, "uuid": "d926f9f3-466f-4c12-b8c9-5a853c41e8f8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48a29ee-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743938696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938696, "uuid": "97fc29f2-bc82-44e6-8c59-5f69cc9e0ed1", "comment": "Malware payload", "value": "61d5ad6d285f4f7f44b24b3a41291f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938696, "uuid": "09f0c63e-1b61-4dac-902e-823f1011211e", "comment": "Malware payload", "value": "6c1b47097c2bca5ba4804110a25bd293eccaa615d781aa41fa6fff0133d65d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938696, "uuid": "253d1120-5cf2-4d89-99a8-780cf1918de3", "comment": "Malware payload", "value": "281b2f6cc8eeca9cdd1440c2da68213691c687c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938696, "uuid": "2f15c4e1-afd1-4df2-9719-f9ddba4d7251", "comment": "Malware payload", "value": "3ac82fa4aa4ea105dfdf7e561fe5f3d40f6d8b38927788802cd33291dbb5e362fa7f4bdd8c623aff93a3311bbc6e51ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938696, "uuid": "83e7962a-2c52-4256-9cd2-5ed7a342f650", "value": "T159952352F513797ACAD4CA7278E59FC07AECEFC89416D140A6ACBE2F10377D0282A45D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938696, "uuid": "6736f972-95b0-48c9-8c0c-21bd5f493031", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938696, "uuid": "1d04f4da-dfc5-40a2-9580-e9b844fc2227", "value": "24576:vannIffeFOxCz9YmC+CvoY1HAo9hbJnxfFjpLffLQ2g3n2j5tFtJQrKCHExj4tAZ:ueeh6mClx15N9n0J32j5rQdHExj46gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938696, "uuid": "2b54a111-89fb-44d8-90bd-9a846e8e3459", "value": 2036224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938696, "uuid": "20f7cad3-ab29-44b6-ac6b-f52e35111a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938696, "uuid": "2f900805-706c-4886-873b-a4bc0c7768cd", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2729d2a-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1743938665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938665, "uuid": "a3b465a2-f1c9-4fa0-aa2e-66640003816e", "comment": "Malware payload (GCleaner)", "value": "887f12379d3bb80d0904bb27986a7d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938665, "uuid": "d0133289-5e95-4b01-88e0-ad95141fedac", "comment": "Malware payload (GCleaner)", "value": "6e0d2219137710d3bfb997776be5839524bd3cc644e98643ae09f8d13f9faa45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938665, "uuid": "814d50f3-194c-4a36-b025-d1c3826c99b6", "comment": "Malware payload (GCleaner)", "value": "81dac3aea7ecce10dfcf804dc4815a281d07f9d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938665, "uuid": "454dc7c1-747c-4941-950f-4885b29beaea", "comment": "Malware payload (GCleaner)", "value": "f4fa65e805afc4b1bc94c99435c12d663d44cda998c0489ca675474c0ab1b094571060c4ab7c2eecab67f3d6163dedcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938665, "uuid": "d74be4c3-977f-443f-a3c4-38728b695236", "value": "T126263325F694E468D0CB933482B8CABA5F3FF812D3245935AC3D31CA9E12AD771596C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938665, "uuid": "8ae26fb4-5a9c-472c-b0fa-0a3f27d3c6d5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938665, "uuid": "d1a863cf-2eb5-4c7f-8a91-0b517204ab01", "value": "98304:Htp5n/upNsDoLGX6k3oszl4e8dOTts4Y+e0hySmmz:Hx+7z8kUVp5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938665, "uuid": "a87c7b73-f865-4433-8079-5dfac1d21d10", "value": 4525056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938665, "uuid": "40abaf47-2cd9-45c7-b250-402cfa48556c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938665, "uuid": "2b2142bd-80f7-4e46-9d6e-bda41ec219ec", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebef3df-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743917614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917614, "uuid": "4dfc1409-c26d-4fd3-814d-db8faa7b68b3", "comment": "Malware payload (LummaStealer)", "value": "9e68f5681f1dd17706e0ba66e1a2dcab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917614, "uuid": "4565ceff-46aa-4435-8e9e-e93b03e943d5", "comment": "Malware payload (LummaStealer)", "value": "6f7f92170dd6b527d6c144f560bee8e30d492c17f91151e757ef91efd0d2da28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917614, "uuid": "da54f11a-a73f-4783-8e00-d1c38c9a8efe", "comment": "Malware payload (LummaStealer)", "value": "0a689bd231850cd5418a94fdae913fd3b3c61bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917614, "uuid": "5636e833-161f-4435-bf28-b3c6c5ff5a92", "comment": "Malware payload (LummaStealer)", "value": "a7b88b0b8cc959cf01786932af69ea5a67bd42137a41f8a819ab961180e537ce8432a3900b0d59084cc9eb447d0e177f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917614, "uuid": "d86c534e-2a93-4d57-aae8-187b5c4ebaae", "value": "T14EA52255DAA9F9B6C89CBD78D933C19E10DC726E60CE21C1517FBB9FC800FA5861B809", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917614, "uuid": "8ac7f9f1-ace5-4127-8763-980e92aea223", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917614, "uuid": "e6c35a81-5c12-4865-a63d-21098ccc08a2", "value": "49152:ud/loNVeR6uP3fYp2peOJOY/vumGtMutexCUREOWVI8XDKKqVceI3qFQkWfS+B7x:uS+BREzIJKVfsWfSglv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917614, "uuid": "80b8425e-89c7-455e-be47-48f3bde289a1", "value": 2158080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917614, "uuid": "44bcd28a-e8aa-4764-b122-429eda6fa146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917614, "uuid": "2a506ad1-0a59-49f4-8fd7-7f0b452f8eed", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdef3eea-1288-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743904003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904003, "uuid": "10098459-2f73-4fff-b66d-4c86461b020e", "comment": "Malware payload", "value": "63be330c320a1deaa9f2325c2931a542", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904003, "uuid": "cf1f01d2-36af-4c92-aa76-447f97c2a7fe", "comment": "Malware payload", "value": "6fd0a5359f12733ce7dbdffedb7760ef1048b9b0f493a41b4743e86b8b5fa8a1", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904003, "uuid": "e591c0c5-f95e-4ea9-8ebc-a96a72563f91", "comment": "Malware payload", "value": "3f517c901e2e3d711169a6376791a2fa9b23e795", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904003, "uuid": "d84fa0b5-02ec-402c-ac54-02afdc643c32", "comment": "Malware payload", "value": "c47c94ec59f21774828383985a8e0da98ce2782598ca4f3b466fd4e08e5f061b90b498b54aff25c8d41bffcbee1f90c4", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904003, "uuid": "9ee77f58-583e-495f-b6fa-e105a2d4afa9", "value": "T1EC07BDEB82FC8653F5D9B0FAB58F9416DC299EF29884780B0C321DB86BF879055163D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904003, "uuid": "3cb407da-d15c-4a06-b82b-75fc53f018e4", "value": "98304:MsY71P+P1lMgc2F3su/df2c1u+/Vwu6tyw0qaIN:M7Vtgw1ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904003, "uuid": "b17ec889-9a6d-45e6-a5e2-6b520d3572ff", "value": 18065248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904003, "uuid": "4d7a01af-f457-4ca5-9a43-0fa4f1783de9", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904003, "uuid": "72e980ed-a571-47fe-8dff-d7746f1f7481", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c1c9e0-131d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743967654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967654, "uuid": "70a6cbfa-f901-4a97-8bd2-b42d0dcae479", "comment": "Malware payload (Prometei)", "value": "e32052baa0928fe010733907460bfaa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967654, "uuid": "73522426-d7bb-4e9c-8aa3-ee0b86764aff", "comment": "Malware payload (Prometei)", "value": "6ff70a6d0ba8e011f1cf5cc18ebd6c06828b71aa9a85622d365d331c4830e5f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967654, "uuid": "0ca5cf98-0d89-4ada-8a52-67f90c001f15", "comment": "Malware payload (Prometei)", "value": "17279c7525c08184015fa820ceebd4024b85e337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967654, "uuid": "566e3291-ea3b-4268-87ec-33b468a21aee", "comment": "Malware payload (Prometei)", "value": "273449f18611f38bace4058697783ff2faa9a5a5d057449ff2ea82c6f7b88dfc355b747b262f6a8f48f3d0f59ff3ce6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967654, "uuid": "c04ec577-c0ce-484e-b1bf-f816b9bce2de", "value": "T188155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967654, "uuid": "32ba1fd9-1101-4625-9e54-9fa17900b921", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplY:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743967654, "uuid": "a70e9a8c-3565-49bc-bb54-582a7c185e2b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743967654, "uuid": "ed62ae9f-2050-4216-bc70-08a41dfc7911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967654, "uuid": "f08c2fce-884d-44a0-8ed9-270fae741f78", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6e1c75-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920640, "uuid": "57115d81-ba23-4163-a2c7-9f1c1e85b599", "comment": "Malware payload (LummaStealer)", "value": "1e1eeef60a849ed6dcba0ab457b0ac41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920640, "uuid": "3d122021-9791-4bc4-b33d-a292063bfdbe", "comment": "Malware payload (LummaStealer)", "value": "708753dedf4acbadedd81207696cb7268b51b8556f506e1a7fdd358d2642866d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920640, "uuid": "ac01cba6-f3a2-4603-ae0c-938e5b87e775", "comment": "Malware payload (LummaStealer)", "value": "9a4a4bfb959503d9f2af1bd3129772118398edd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920640, "uuid": "3d2547a4-2c66-4ac4-b741-9cc6d5f402b7", "comment": "Malware payload (LummaStealer)", "value": "d8d7ff79c5b2a14a64f8498bdb72d6318d3ed2ef0d762a66bb4431d46eab37d12a5ce1bcd1d59c5c7840cf1c9b453ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920640, "uuid": "17850f18-26b8-41e2-922d-63a477b81bff", "value": "T132D4F104B2B508E6ED63427E5B559701B6337C278734DAEF02A486221F17ACD5E3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920640, "uuid": "8f66145e-2848-4dbf-a305-c0093f86da8a", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920640, "uuid": "37e34383-5bd1-4367-9f4f-68e8153f440d", "value": "12288:1AJvsvm4soaUtcLZAZsr8MAOStuoWhWIdiqMJsxL/z0zkXmYHrVqF4:GwUXFsSTdinsxX0zk/HrQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920640, "uuid": "43e4e370-fa4f-45c9-819b-a252f8aec841", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920640, "uuid": "f9377350-456e-4813-b4c2-777efb1ea026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920640, "uuid": "87dfbc5c-3c18-4330-8ff3-55236f766942", "value": "SecuriteInfo.com.Win64.CrypterX-gen.30467.852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c49f086-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743915435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915435, "uuid": "ac39b913-cee4-444b-a03e-6a8a4f7a8b30", "comment": "Malware payload", "value": "c0b99a3ee1d53911fb86a4ead930738d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915435, "uuid": "e5913c2e-cb05-4825-af77-1715f50e1f8c", "comment": "Malware payload", "value": "7275e18f2f7435aeea993c3a7497997a9b52980388d54bfc1b8e0e2a0ac04453", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915435, "uuid": "50c6bad5-aeb6-40dc-ad0b-291d66ab169d", "comment": "Malware payload", "value": "8aff860a2a7c4da15062ca29a9a48be6325b0a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915435, "uuid": "b224b9b2-438d-430e-bbc3-2d35929e7c0f", "comment": "Malware payload", "value": "75dd1c716762d847814b1c7b770d3f71520858ca616a551d973db0c49b9964e6258ef010da35a855cdbd0a0d0216d158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915435, "uuid": "5a45a4c0-3608-4316-8320-1c2964ccb511", "value": "T156133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915435, "uuid": "b41065fc-f248-4228-9a2e-cea5a972813d", "value": "768:U40J4bzio9RfQRW0qRGQ8Jt8h/VsBKltn2susfzFuMldW41LFfwk:P0JOC+Qqh/FxjMMlddLGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915435, "uuid": "55325700-2282-47b9-93bc-c49ade48e9fa", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915435, "uuid": "9489ae69-a63d-4896-a1d5-a02bbb2bda68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915435, "uuid": "a9c2cbc8-f682-4f39-8590-d6da1aebd3fb", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb213717-128d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1743906119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906119, "uuid": "95c027ca-26a1-40e6-a443-c312591ce9c3", "comment": "Malware payload (Gafgyt)", "value": "f6f5d2ca40d091bbdb5b6e8e95aadebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906119, "uuid": "9dac6c7c-d48d-4e02-ab58-edc553266fb9", "comment": "Malware payload (Gafgyt)", "value": "72a283ef2d020d148a1ca602a4fa5b83b9046cb108fabff9807ba5fe3998e3c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906119, "uuid": "8de4ec61-505a-4c6c-91c8-99c74373a401", "comment": "Malware payload (Gafgyt)", "value": "0a81e87100d148a0c100216589e79de967c3b038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906119, "uuid": "251784b4-8869-4a9b-9a9d-8f6c00f93e66", "comment": "Malware payload (Gafgyt)", "value": "aed5ee1d61da2ad810ca99f82b78a10522d4042e9ad088c303883602f6abc1a889637ccb5b632dc9f9655a65e1be5b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906119, "uuid": "28583bce-ba7b-43a7-a3a7-9f3f3942752f", "value": "T107130A0BDA02D3F6EC4756B2556AE3BF833066399470CD5CEB942D28FB76AC0B910256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906119, "uuid": "9d03af85-6951-409b-aa76-cb40887228a6", "value": "768:F6F3flxndmKhDd22haQxxpAxd3U0h3Wk3k2gOX1XxPWVTpLR+AzOBQ:kFPlxndf22h/xxaH333j3kaN1W7N+Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743906119, "uuid": "7ec9b8fc-3e27-4655-ae97-ecf4c2382526", "value": 43152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743906119, "uuid": "94aad8ab-468d-4b35-857a-ba6e4ab8ca47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906119, "uuid": "4e759ff3-c163-4e62-a5e0-8492bb236c50", "value": "l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f249198-12db-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1743939250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939250, "uuid": "a42b5c0d-fdc7-45be-b62f-2ca208373d07", "comment": "Malware payload (AsyncRAT)", "value": "ea69167000ca8cd93a6f327c19a1c7c9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939250, "uuid": "8ed4ca8b-aeb7-49cc-a144-e5ebac5ae617", "comment": "Malware payload (AsyncRAT)", "value": "73c6fa2e52043649f60d92324da6b3668553539f4c6b43f595e4e093f7883934", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939250, "uuid": "feeee7c1-faa4-4e8e-93c1-aff418fc8c2e", "comment": "Malware payload (AsyncRAT)", "value": "2af8e932bd1a6bf0c0074ef98e12bc34c26f8994", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939250, "uuid": "d80c26a3-a223-47d7-8ee0-7f2edb57ae8f", "comment": "Malware payload (AsyncRAT)", "value": "4bb77d87d44f4665e97090a8d53f14f6e26818554a5398c929d37e94edfdd698fe21d2e4a797a3b6d5e12599acdde4f6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939250, "uuid": "aebf01c5-9278-4371-b806-2f37056b4ae1", "value": "T14D133B483BD80625DAFFAFB619B365024671F9179A13E74D08D0A59E1F37BC08E413E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939250, "uuid": "ef6e7865-7819-47e1-a087-51a6ee6a05dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939250, "uuid": "abd320d9-5a13-4ca2-936f-422a08c39ece", "value": "768:tlqRZ9SFb+U89ORdtwDTUF59EWlOChlf9dTsL:tERZ9q1HtgQF59EWlOC7VlsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939250, "uuid": "f4e1b249-9b84-48ea-9546-d9389247a754", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939250, "uuid": "988b5bd6-0547-48b8-a57b-c7ea485c94f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939250, "uuid": "3f14abd2-187c-4ef2-95b3-f95cedd3526b", "value": "PJsPp3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9200d23-1294-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743909122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909122, "uuid": "499c5188-c284-4bcd-a56a-c0d8434e5720", "comment": "Malware payload (Mirai)", "value": "a012c22cd997614f47cbae656e1b2477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909122, "uuid": "d9236436-23bb-4f3e-896e-4f7d742121c5", "comment": "Malware payload (Mirai)", "value": "73e7149a0468d56439e7393910f2a1dc8bcb81c674b2ce2e5259829085ffcaeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909122, "uuid": "bf1238e8-7512-4ca8-8909-18407a8ae587", "comment": "Malware payload (Mirai)", "value": "87b788174c71e882c3a5ecb8973eeb4280d81619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909122, "uuid": "3e61bab1-1186-4420-955e-07e383ff684b", "comment": "Malware payload (Mirai)", "value": "6144910b8a2b86c0c0bf3d7f9e9d5119dcda3e2bf5ea8c98c70662fb34a8164f1a1a1b3d842f4f5b2cfc344b6b9a4932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909122, "uuid": "3605352f-640b-42d5-a7e8-6171f6e0806a", "value": "T1E614827AA7615FB7D80ECE37019E4901188CDA4B12D92B6BF2B4E518E79BD4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909122, "uuid": "307b0318-992a-4754-a5c6-5a7299b14910", "value": "3072:ooIR900aTESn9teFTmlaIvuOHDDTlPWDyaejZh:oowVSeFTmF/DDTlPWDyaejZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743909122, "uuid": "9efffdb0-b789-418b-9711-66d4350cf0f5", "value": 204660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743909122, "uuid": "37c2b316-dac0-4662-af35-71713c7a0031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909122, "uuid": "0ecfedc9-a0a5-49e5-ae46-59020edfdca8", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1eb4ed-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935278, "uuid": "1432caf3-dcf2-44e8-8d41-713607fe1e89", "comment": "Malware payload (Mirai)", "value": "26942a7bc58aa01eb2c88c619ba7d6c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935278, "uuid": "9663d68b-4234-4d27-a15a-db02e2082286", "comment": "Malware payload (Mirai)", "value": "7435072b9747a4ea4e2b8fcd79aecfc2cb360d9b6fc6167ee94f8d765f22858b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935278, "uuid": "0f2021c8-d87f-4a0d-a2b4-b7b9ff0b63dc", "comment": "Malware payload (Mirai)", "value": "dbd87953adf8b2036c00ef5248d30756fdd4beb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935278, "uuid": "cfccfe0f-5da7-4cc9-81e6-516e676a313c", "comment": "Malware payload (Mirai)", "value": "9b44fbc63915af6a6d2724b62827cb0b68b53797846cf89d6370d7d85c1e0105a599e0e6eeb8fba6b4188175e1fea584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935278, "uuid": "a3ab36e0-e518-425b-a685-78bc8d89a990", "value": "T101B2C1AD6F1161D9CA59C6F02BB48FE06C340F67BD037C0E2271995B8E0A1F539429EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935278, "uuid": "a1aabb7e-5df7-47e1-9263-adca8312d981", "value": "384:/FrfQ4Ri82kUFS68+o/h5RP9wQnqKSO1OMv357sj0umdfVV6JgGlzDpH7uNj1JbK:ZI4mkUk6u559sO1n351PdCJgGlzDpbuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935278, "uuid": "3b36fcba-948d-40ff-aad5-3353002520c5", "value": 24168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935278, "uuid": "43e85171-d03a-4ec9-8a8c-1532e2969f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935278, "uuid": "f8299f89-da1e-4859-b217-6883334dd28a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e94d9e-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918114, "uuid": "24a68aa3-dd7c-4f8c-a547-21c3a1f5d838", "comment": "Malware payload (Amadey)", "value": "f8d4d445d56eb238ba6423eafa7ff25b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918114, "uuid": "34f96d25-c908-4b05-9552-12f504fb9a1c", "comment": "Malware payload (Amadey)", "value": "762885bb99bc39ff22ccd313a82fe23d6db88f5516f9ec004cfdb05f75ce2bde", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918114, "uuid": "ce6466ef-18e2-436f-8fe1-d907002416fd", "comment": "Malware payload (Amadey)", "value": "d8311f0490a1e998dcd8a54b192987bfd01c9cd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918114, "uuid": "d823d0c2-4581-49db-80fe-8374cc56da73", "comment": "Malware payload (Amadey)", "value": "eaacd50d3a43b33e5da8d4a20f1bd4414e2cf5d01d134212046a6420b81430b65078f2ea4fe27f12fddc3fe380bd4ff9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918114, "uuid": "a3b532e5-13ed-44f6-8dec-d8d6a8ebcbe9", "value": "T1A38533ED8638877EE94D08F04123EAD3BB0C2FC16F5AE921759505692B37F489D3AD84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918114, "uuid": "3a98c4f2-9760-4b00-b02e-66205fabf037", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918114, "uuid": "b9b0ce11-2f3a-4eed-9d9b-244f61a9aa6c", "value": "49152:R+gz7icaxCRRQ8wZw05obl1SGehdEctznKWhs+sTm3zb:kgz7+CjveFybl1SGIdhKWeNm3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918114, "uuid": "8aab9b61-d7ba-4c35-bd31-5b2113388f49", "value": 1873408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918114, "uuid": "1672d41e-e8df-4f91-9a98-1876509a7118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918114, "uuid": "a109e87a-0f02-4201-8950-30798bc1fb57", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1046883-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743934046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934046, "uuid": "158d6d69-2a9c-43b1-af03-72fcc01d8382", "comment": "Malware payload (Mirai)", "value": "3b14119fbef904117d4a1495f176bcd7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934046, "uuid": "98a50f22-f0d3-43aa-9244-4f27c9acd15a", "comment": "Malware payload (Mirai)", "value": "76ed1dac0e6e858d1a9268854ed6f67b86a4513b986767820dbfacad8f11df3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934046, "uuid": "6c3a6a93-051a-45a6-a756-74d7076e3b70", "comment": "Malware payload (Mirai)", "value": "e59af03ee9d4e64a8f8261049668990b64bcd3df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934046, "uuid": "c226cf7a-0f5d-465a-8f44-9b53fbfbaabb", "comment": "Malware payload (Mirai)", "value": "618bf25d1a7b71f8a4458d5baf510fdffa5d29ea3df377e3024226659e57511d2362e0f2d075132c7a3312f025dbc1c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934046, "uuid": "e630b3ae-b342-41b7-b878-c57afadb5055", "value": "T18DC0804550137118C349BD11E42D514D3531C4B071D7074BB5841C72D5CBE317D64AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934046, "uuid": "5e71e1d4-d270-4752-b145-149ab0729d67", "value": "3:LxAjeMLeBUlDlTgKzSiwlT3u0lTveWwVxAjD1QIM8NBzSHMx8AQMTWG:L2CBAm7RjeWwV+1QekMxLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934046, "uuid": "e9dd4e18-cab0-4ffb-81e6-d71cc6d62064", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934046, "uuid": "aae0eeaf-018d-4adb-bf9c-2a4452aa7180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934046, "uuid": "c0dd8bbe-65ce-4279-b9de-3b9012383f8b", "value": "sky.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d226ff3-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918014, "uuid": "e4b62c7b-91f8-49a3-8bfc-7eb597a6a9d5", "comment": "Malware payload", "value": "04c3b7136b4c0804b8514c2be31fbf8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918014, "uuid": "4267b0c9-02f2-4dad-b742-0968cdf5287d", "comment": "Malware payload", "value": "77560dadc98c263402aa75e8ef6be739a275c68c274b5cb6a062413adc28c89a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918014, "uuid": "7b9de468-f7d5-4c2e-a9ba-1ffdac9a0ba8", "comment": "Malware payload", "value": "a59e10c38f0ae687ca8487d2faf508d9226d8dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918014, "uuid": "855f33a3-513d-4e42-9b86-a5642f901168", "comment": "Malware payload", "value": "e81a43fac3724fa9bef79e7ed60ba202efb5e2a187d431db1183c7b0c79a367eb1d1099846b501666da09eae1da177b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918014, "uuid": "76ba6566-cb27-4b8a-9b1a-a6f9ad65163f", "value": "T11B160122F249AA3ED0AE0A325177B954993F67B1F956DC5683F0494CCF39880273E64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918014, "uuid": "dba8138e-3478-4fa5-b717-1eaac32463cb", "value": "98304:G5a9IjDIhxKtPTFELvmpuwPsz63Ob0lecb6UdLxeA:G5aG/x7Fmssz63MEeo7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918014, "uuid": "e247669f-23bd-46b8-94a0-bdb936e6095f", "value": 4365715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918014, "uuid": "9da458d6-cc24-40d1-9c1b-0a5b378aa231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918014, "uuid": "bca2bf1d-a90e-4f33-81f8-e6a942868357", "value": "41m98slk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb00e6d5-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743934063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934063, "uuid": "fa11795a-1085-4c2f-ae61-9cd1481f65ea", "comment": "Malware payload (Mirai)", "value": "82d244931452a9f30c6914692fe5de5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934063, "uuid": "47c8415b-7dc7-4bf6-a1ce-74e4238f5194", "comment": "Malware payload (Mirai)", "value": "776e4aa95bae238337c464219ec233ade471f194eb93e5c744f32b2a4611c39f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934063, "uuid": "6ee33baf-3ca8-41c3-a15d-158862359699", "comment": "Malware payload (Mirai)", "value": "a4556e941facf1d2bea3d16d23a9347dc04d21a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934063, "uuid": "59186f80-6c93-4d5a-aa93-c444ab42abfd", "comment": "Malware payload (Mirai)", "value": "24b8b90e259d64c489d4ea5f873d12d97f9263ac260c199741e20c644687b8a27167444d9fbfacee9c06975a225f46f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934063, "uuid": "f7634d8e-1ad7-439a-b06b-4ebf6b86265d", "value": "T14AC39ED7B28F6966C42502F60BC78B8E2E632212DE4BD5D36D1DA53A387C1DB490E7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934063, "uuid": "a7eb7d28-70db-470d-ab65-5e7cbaa46721", "value": "1536:oz2wLT3+Dvy9mhoCWXcDQD+Pt9PAnRlhNlndPg5d9lnO//LWC:ozf+LCqqcDQDQTAnRNlndPg5dsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934063, "uuid": "70cb3654-1384-4363-ba54-fb1c8950fdda", "value": 124304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934063, "uuid": "17483178-5f3a-4223-9a83-4bf3fa46fb91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934063, "uuid": "26519464-5141-4036-a9d4-ced5b3b4a92b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33490bd5-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911823, "uuid": "d3dcd152-ab13-47fc-b03a-8fcd3ef29a53", "comment": "Malware payload (Mirai)", "value": "d76ad7a3d762a052c14396b7b1479a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911823, "uuid": "56d7dfc6-f326-442a-ba13-3623af1f2818", "comment": "Malware payload (Mirai)", "value": "78963d4b7aca6f644b096321f0a3cf48d3060046d73fef0ac1939c0e7bf5bec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911823, "uuid": "e0755f2e-c3e0-4371-b071-d9b66c9f3752", "comment": "Malware payload (Mirai)", "value": "81f3a74353d6221229ba160dc6349feacb7bcb0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911823, "uuid": "06746268-0d81-4cdf-afff-5c01048d837c", "comment": "Malware payload (Mirai)", "value": "73d740e74b449fd66d630254990eabe8cadd0d710d1a5f2e3fcdd78cbe959b4e064f8aaf1923512db7b995840b1308a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911823, "uuid": "ca080638-1556-45a5-a620-79726fbb4b73", "value": "T14433F1D9F44898DFD8DE48241AAEEE30519D604077FE6F08E352EE8C56D154A728F8BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911823, "uuid": "906374c7-1d20-40b9-a145-53bd9ae8401a", "value": "1536:CGiAllZRAsJcDxrNAmEo9RCdLvxJJUuYe0rhSF:C/ARFWDxeugfHx0rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911823, "uuid": "5fb2b1ba-3013-45ee-8ae3-7b6162db97a8", "value": 52424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911823, "uuid": "55028e7f-755b-425f-97cc-9334ae415ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911823, "uuid": "c42ba945-80ab-46fc-abd0-7ba443cd92ca", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d570af-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743918134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918134, "uuid": "e76bb781-fce0-41b8-9b8d-bd78b8ba47fc", "comment": "Malware payload (Prometei)", "value": "55a8c99b38db3921a1790afcc7e7e10e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918134, "uuid": "867501c3-d325-4b31-92ed-3d537125ede7", "comment": "Malware payload (Prometei)", "value": "790d1834b77366b329681652113d30c12c5635d1308feb4a63fdd52003554562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918134, "uuid": "a365a178-3455-4c0f-b2d4-e2d9ea2f9d4c", "comment": "Malware payload (Prometei)", "value": "a152a13d23b83303501e0f1445f930988cef753b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918134, "uuid": "7e79fb5a-58ea-47d5-b66e-381f0a709d98", "comment": "Malware payload (Prometei)", "value": "c2790b596abc67feef0d962ba53fffb4799ca8aaec1deb912539657d35bc7c83d645c78d76ec0057ee3756a2524d36be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918134, "uuid": "ba0dab5c-e975-454e-82d2-8e3f8a242171", "value": "T100155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918134, "uuid": "1b4e8f0c-ef4a-4c5c-b953-443d8064f3cb", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplj:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918134, "uuid": "d41d0a9a-0a6a-45db-ae2f-89ca07ba99ae", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918134, "uuid": "de25f615-8c63-4607-9001-f4618dd49fd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918134, "uuid": "e767384f-c5cb-4040-8889-91b4eac68120", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977ee821-12bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743927453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927453, "uuid": "a6444ab0-f745-43cd-9fec-4c13173ac8b2", "comment": "Malware payload (Prometei)", "value": "3dafd215e0d866b0c91d69180c2af307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927453, "uuid": "fab71592-147b-41ce-b46c-804292fcc586", "comment": "Malware payload (Prometei)", "value": "79e39640754afe5097ff6ca1d7b6b45c512365684ba519ceed709d036d82e030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927453, "uuid": "f9956b5f-fb5b-4100-8f5d-e79cd0882e34", "comment": "Malware payload (Prometei)", "value": "9c727a510c907f876207e4d8f22920565cd2d881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927453, "uuid": "b5b51c90-dc86-4541-8c64-6b0c29937b86", "comment": "Malware payload (Prometei)", "value": "b535fa2d2891501b15c6d30d873e990a2f5c3d606aa25a77b9e7a94c0c0dc2d96531ef49bae17ea8d39033c1d2efa9cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927453, "uuid": "5f04a6d4-6295-40ab-8a92-e9206dca930c", "value": "T119155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927453, "uuid": "f30c8bdf-b90a-438c-98c7-ae23300706ef", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplB:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927453, "uuid": "cf8c1a47-763d-4999-a6d8-1aebf9c375e2", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927453, "uuid": "3bc228c7-eb31-4985-aa60-dd6d691ce49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927453, "uuid": "6716a85c-848d-410b-be61-ed00500733a1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956ff530-1300-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743955367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955367, "uuid": "9867bb82-f041-4bc9-9030-c0cb64758a0e", "comment": "Malware payload (Prometei)", "value": "9535ad05149abfb1b96518c432c5cbbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955367, "uuid": "3f5957f0-145a-4661-b9a9-2e3bf901dd43", "comment": "Malware payload (Prometei)", "value": "7a36fe813fb565a2d064d764027d70a67d3d75d3ccd18d5db21761051cc16fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955367, "uuid": "0437f3bb-299d-4533-b75e-be016e9ba67e", "comment": "Malware payload (Prometei)", "value": "50d05606d08576c50b48196defce9f63e55b1e2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955367, "uuid": "72416ecf-2669-47da-a972-a291b02a80b3", "comment": "Malware payload (Prometei)", "value": "5ff8d4b5f88111d872c0da76c38d3a2cd99a908d31ebb88b4192d832670058caad43cbaefe1e3ee61901c92fb5e8f41f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955367, "uuid": "3402e079-6f2f-4e3b-9f8f-8b310eaa1b93", "value": "T1A09423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955367, "uuid": "18017f79-f95b-45ea-99ef-e4187b066d7c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743955367, "uuid": "bfd09a17-68ee-4bbd-bbfa-d8c2416e4d11", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743955367, "uuid": "44de11b2-c647-431d-a531-ca88a7d47525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955367, "uuid": "192c6aa7-e4e6-482a-ab8b-e7e53c43020c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b9df3b-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743928766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928766, "uuid": "6ffbe5f2-7b4d-4791-95ec-780ab8842c46", "comment": "Malware payload", "value": "9e7b72fc6d4a6b523db31a92955fb0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928766, "uuid": "2288d513-c8fa-4950-ab21-44b7f40a3217", "comment": "Malware payload", "value": "7a877c8cab63651290d7fba73619a22157de658f056c708c154bb04bea3ceb7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928766, "uuid": "1d0797da-2088-4159-98b8-2577a47146c1", "comment": "Malware payload", "value": "476824befa9db5c437a0a3e322219a42f0326da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928766, "uuid": "68732af4-b67c-4e08-96e1-0354bad322a5", "comment": "Malware payload", "value": "bdd457bd85194c0fad0a12769fd42a2dcbad303fa632a2709e977224968f0b31cd3903866fe74824fc65b03780fbc652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928766, "uuid": "d1a0f0eb-1f12-4f1c-8a15-4be03fbca8fa", "value": "T1C6867C07ECA545A9C4ADD330CAB69253BA717C484B3223D36B60F7786F76BD0AA75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928766, "uuid": "059129b1-0ddc-4c7d-9549-ad995c17249a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928766, "uuid": "768ad142-95c7-4bdb-92b2-ad1bbc4cf9a5", "value": "98304:cRiSskFUXcgIEusiVbUhK/LgVZgOeZ4R:GJUXcwwU+SfeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928766, "uuid": "07c45d3c-9d98-40c6-8b01-cdcb5bf388af", "value": 8190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928766, "uuid": "789b5324-8c20-4037-a2cb-7bc2e85cb4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928766, "uuid": "6a7ebed2-33a2-4d13-847e-0bbc98264f26", "value": "YMauSAr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525e026c-1296-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743909728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909728, "uuid": "253d4aca-9d87-42a4-b530-0dbc945b6214", "comment": "Malware payload (Mirai)", "value": "efa67d792222efd7b4391772354f01ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909728, "uuid": "e44b2c7d-24ba-4b19-ba3d-d01a5cfecb4f", "comment": "Malware payload (Mirai)", "value": "7b6229edf2bb89df853b704eeae31faf73386a59d72eda274e9865a91d14d604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909728, "uuid": "89f6a216-a192-408e-af55-7c9520d9b24d", "comment": "Malware payload (Mirai)", "value": "e8527f4dd503afd4c3410a79bcde340b58f4258b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909728, "uuid": "2bdf9c35-806e-4143-9bbd-4a123a3007fe", "comment": "Malware payload (Mirai)", "value": "639732a0fcef1a1ed903d860b0c5ddb9b5f6811ffdacc84852d5bc2af0a42862b8779fe7539bc068d799fb69c5f27b2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909728, "uuid": "0fe9194c-36a5-4151-976c-ef5d159a4de1", "value": "T146E30976A4A35EB7C0126975357E2B640F29BD531F0F0997653DBAA0077B0CBE00EE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909728, "uuid": "375ebd7d-7d4f-460e-8bea-b3b11461d8f7", "value": "3072:mr5oMcsll6fpzOiT38RVuGmeX8TwacJwjWCIDfW4AG0bagaF:mrGjsInrEr+jWCIDfW4AG0bagaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743909728, "uuid": "0fd8702c-0fe3-43df-a045-89753098ad02", "value": 148073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743909728, "uuid": "425dd45a-eac6-4ca2-ae9d-82cc06dfa2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909728, "uuid": "6efa4ec7-33ad-442f-9684-4ac7515733b0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a051fb58-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915442, "uuid": "aed7c960-4a5a-42b1-9eba-84eced049e00", "comment": "Malware payload (Mirai)", "value": "2647df26dc6b720d82c286ed7f3ac8c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915442, "uuid": "eac17929-2e26-4ec0-98fa-67adbab4b6c4", "comment": "Malware payload (Mirai)", "value": "7e06a319c1481fa600a78a30bd921175c36cf3807e4e64f80f410ee9fef77ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915442, "uuid": "b0a4b583-05cf-458a-a2b3-d58303aa93cd", "comment": "Malware payload (Mirai)", "value": "45bb5fe556864507af2795e87baccb7a2a081884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915442, "uuid": "407084a3-02df-4dc0-bca0-d5d1ade79076", "comment": "Malware payload (Mirai)", "value": "d3a7883ca77279505c42847686fd9cac57bbcb4f3d4fb14a3ebabf16d8306dace13fd2027a842b37105e50f7152d2619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915442, "uuid": "a1d8ba8a-897a-4d28-a04b-86dd852bf2ba", "value": "T1B5C32B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915442, "uuid": "452a3868-e72d-485b-942d-bdf11a1a6d3d", "value": "3072:5QK3qOAWqKUUoev+YPaOS6cos+EuNM/9oE:5QK3NjUUoevbCOMx+E4M/9oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915442, "uuid": "45b8c0a3-e1cc-47d2-b0b0-b7f3bf79708e", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915442, "uuid": "14a9e03e-b367-44dc-8571-40a1c235f88d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915442, "uuid": "7c17acc7-b8f4-4945-8ae9-650c2247dd47", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82df00c-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920663, "uuid": "46b885c9-84f7-4d09-b991-352a1a2289f3", "comment": "Malware payload (LummaStealer)", "value": "66d654cec4a3c3df14ffe909573f4644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920663, "uuid": "0dafd49c-635d-4bca-bdee-36fcb338ea82", "comment": "Malware payload (LummaStealer)", "value": "80367bad4d844d7ab8cdab4d8485973fca33560dd3b424bbca5c359733fad308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920663, "uuid": "e05cf3e2-f709-4f1a-99a0-cbbc774d77a8", "comment": "Malware payload (LummaStealer)", "value": "eba83a3633e4fe5e6544b003b76f859ba78e7dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920663, "uuid": "9c9bbdc9-6885-4ab3-9476-45c083aa8229", "comment": "Malware payload (LummaStealer)", "value": "383e9a0e422b2923a1a4f0485ea59f6407c379da4834baaf61d9e7c41e142788de2fe4732f9b14002385c1e8685e8f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920663, "uuid": "3dcf45c6-1cba-45a5-8be1-7751b559bc8c", "value": "T1F555338C32B8ADD6D36A263A12EA100F39E82DD01569C49796FBDF1C06778779870DD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920663, "uuid": "19753873-020f-4a17-ab20-bb787b180fc6", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920663, "uuid": "75bebfb8-2048-45ee-989f-352ada94bab2", "value": "24576:TdP1ckdawcmg4w9rHo4m8/q6XCn+u+2c0Rqe7/cLHpB+:RWFwiDo4+mCWPYqe7/uHpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920663, "uuid": "58bf6723-967e-4d1a-b682-2cb52ebf7eff", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920663, "uuid": "59d77102-8014-4447-9b02-18c128354b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920663, "uuid": "f0cf6417-b06c-4024-9292-6de00ac31967", "value": "SecuriteInfo.com.Win32.Evo-gen.21722.19291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c428a99-128a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743904617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904617, "uuid": "d3f1ddbf-9d3d-417c-9527-82cd2c0f50e2", "comment": "Malware payload (Prometei)", "value": "05011221e7fbb579e5f2456fc2a1039d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904617, "uuid": "b77c05e4-5a0d-45d6-a81d-93a03c945a08", "comment": "Malware payload (Prometei)", "value": "804ee2ef4e9351739a443d6e69af4987299abee6cce764926585ec579ea69ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904617, "uuid": "441d89c6-f3c4-488c-b7d8-5eaca0cf0936", "comment": "Malware payload (Prometei)", "value": "a94f839478cf82649326e2e4107cf52750bddcd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904617, "uuid": "1a99bf6e-8639-4348-b286-caf69d76e419", "comment": "Malware payload (Prometei)", "value": "86d08cf1feaf71be6aa92ff7220779c430e2d9c7aef5fd8db9497b89a1f7806b511753ae40f613f2f02986d6c7089244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904617, "uuid": "a2d1d249-8ced-403a-be6d-94576d69a910", "value": "T11F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904617, "uuid": "e3b8aea6-71cb-4536-8159-f9ad95a99758", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplJ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904617, "uuid": "3268017e-d95b-4603-9024-d2db0b29b317", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904617, "uuid": "d3c0a51f-c8b2-49c4-9bfb-1c838df4e766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904617, "uuid": "6a8b728d-e50d-4494-bee7-54ff39fd249d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6062b8-129d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912726, "uuid": "6a43dcaf-3251-4bf1-b102-c3731c79e1e4", "comment": "Malware payload (Mirai)", "value": "d4547127048ff43df59f97416bafb792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912726, "uuid": "310f89ac-4e5c-443f-8835-554e75342f83", "comment": "Malware payload (Mirai)", "value": "80a5beb5cce148b3eefe01ab555e3b6453a5b4955b141391b7656bc5235390f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912726, "uuid": "52453288-4184-4250-8a88-a425cb52d7bb", "comment": "Malware payload (Mirai)", "value": "754bc0aaa865a881a4ce2f1b575c9eb64c2672e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912726, "uuid": "f128049a-97c3-4e5d-a907-fbd78451bfcd", "comment": "Malware payload (Mirai)", "value": "b9e154273a168c6940e512010f373fa39bae92617e5f030107cdcd291e5b78ab9ba3cad1ba44838177e4cfd3c2e53c9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912726, "uuid": "abcb4c71-15dd-4628-be40-ea7ceb622ef7", "value": "T11F3302BA0A0207FDF21E907177F40B912AA71F755E83DD8BE100EAC78E5506E35439AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912726, "uuid": "9f158784-505b-4892-8560-f0aa7458786e", "value": "1536:rOI1ZoQhfgPgzC5kRJ4yvUt4Ht/KtjaaVJu1:rp1ZoKfxCn0B0t7VQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912726, "uuid": "a5718cb2-e76e-4217-b67a-c49b12f11a34", "value": 51616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912726, "uuid": "ef76fb38-91a3-41d7-bf92-1fe44db4cea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912726, "uuid": "1351f8a5-cad4-42b0-9097-9cbe9450e2b2", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d7b57a-129a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911524, "uuid": "d07bcf0f-a726-4fdd-8b81-be3c96c74d02", "comment": "Malware payload (Mirai)", "value": "1efaa384ce9f5768670f0917af6cc78f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911524, "uuid": "fed066ce-f42f-48a7-b7a0-a864da81aed0", "comment": "Malware payload (Mirai)", "value": "80eb1365207ad51ef905485d3459048b0e08a874992696accee90c4890428b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911524, "uuid": "1560d3ba-b59f-414a-bd31-2f96a01a2b11", "comment": "Malware payload (Mirai)", "value": "af44acc34b94710376a7b37ae4f1e6bce2bfcc47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911524, "uuid": "5d12c820-4fe0-470f-bd96-3cea6904ecd2", "comment": "Malware payload (Mirai)", "value": "2569c36d1c5ef1e1107117ca08109dcefac090b311b2a0510cda3fc78fcf380488b853ab6d5b4bba1655cd3fe5fec77f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911524, "uuid": "dc848808-cf90-4d3b-92e2-9887dfb3bc28", "value": "T113E309B6B920DF66F40B973A04D34B21BE70BFE70B532522731B79A69D362D41827E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911524, "uuid": "809304cd-9da7-4107-b2d3-f861476d7218", "value": "3072:3e8L6JbKAmIIZZ3Lxyn5jU4QkGyVgBXE2uDwYR4APtRagXh:3e7JKAmzlxy5jUhyVU9uDwYR4APtRagR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911524, "uuid": "ff18805c-3883-497a-a09f-0739d8db04e7", "value": 145370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911524, "uuid": "5beff5cf-7272-4e4c-b6bd-fe4c6f227154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911524, "uuid": "3f2c3f2c-c108-4acc-bf29-95b01b2919a6", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649ef28b-12a6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743916631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743916631, "uuid": "33c184c8-786b-4b25-bd21-edf936113de3", "comment": "Malware payload (Prometei)", "value": "b566b17f57cc5d946a952f19e1cc3aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743916631, "uuid": "9aa3913f-c280-49e6-a2a6-e2ee35a80c23", "comment": "Malware payload (Prometei)", "value": "810b7485beaeb34af73fded7c261216144e76e342e7c86c66b535128633c04de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743916631, "uuid": "9dd9db14-9a49-480f-a3e7-49f98b20459a", "comment": "Malware payload (Prometei)", "value": "a6812642a84f41043fcd158e845d49479852d1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743916631, "uuid": "5ba051a4-db58-4331-ae5d-11c4a3acdb2f", "comment": "Malware payload (Prometei)", "value": "08c8c23be1e1fb735b38d0feda800148f5213eaa58f50c4830e8317f041727667cc110ae3dc6265078625bdf2300126e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743916631, "uuid": "e9bcc77b-702c-476b-bcd6-dd5e4c62acf3", "value": "T1A49423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743916631, "uuid": "8971efca-abea-49a4-8f25-c51babbd3e43", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgN:25WOSACZSV6eKRH5EPiamb4DsDwwcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743916631, "uuid": "747e1016-03f8-4cf0-bb95-5520e34e0b2c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743916631, "uuid": "8fdcc495-185d-4be8-a9d8-235666810239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743916631, "uuid": "9f417d2a-7a94-46f2-93d8-2746ecb14a67", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b3fee3-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918102, "uuid": "754a5f4b-eade-4f47-a07e-7ed8c5677ccd", "comment": "Malware payload (LummaStealer)", "value": "f0368d71cd22d1022867c45191087a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918102, "uuid": "a29e5841-1b9d-44ec-9fa2-5a0a74fe1d2f", "comment": "Malware payload (LummaStealer)", "value": "815792a88ea62c7905ba1d01f7f0c1a5e5dc031e5806f62ee5d6e82a34d27c0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918102, "uuid": "9722a63d-dac9-4ceb-a127-7a26d340c144", "comment": "Malware payload (LummaStealer)", "value": "85557075b619c29b8b666f08deb2ad73ee566c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918102, "uuid": "4da327da-4580-43c1-9f24-2f2cdf97e214", "comment": "Malware payload (LummaStealer)", "value": "9faa53e09e02dc83e4447497b0cec356a8715572051b80dfbf8251fa19cb388e0df801b52336739f367f09ba1131d654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918102, "uuid": "85a0c3ef-279e-4882-8005-f9771abe6af2", "value": "T1749533D9EE6700A2D1AC8C34D2CCE950A2B06FBC5DC2695D036FDA3A7D1DFA681BD105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918102, "uuid": "72f3607e-0ab5-470b-80a4-751959219a51", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918102, "uuid": "47f02f8e-104b-43a7-8f23-0ff779fd4686", "value": "24576:zRLrKIsBUtxGBhmrKwxUnSabSzNTLDlmvWluFAk9EuCCDESaCKaLmId8cvV5Ev+T:zRLrK8ahmrKwxUVWzNz0d/j/aImIdlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918102, "uuid": "e8ab62bb-9e68-4156-95a3-73e0b23806c1", "value": 1884672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918102, "uuid": "1d4d9266-5193-4186-8396-abdc4b89fa9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918102, "uuid": "ce891964-652a-4db2-8c77-b039aab234f5", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06577ed9-1312-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743962858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962858, "uuid": "5fdf36d1-4012-4283-9fec-a442ff40e3d5", "comment": "Malware payload (Prometei)", "value": "79eab718600ed721651d7dd599d6f48d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962858, "uuid": "68856fa6-d661-48a3-ae74-1e30f423d191", "comment": "Malware payload (Prometei)", "value": "822454946dd322e20f64bb40336dc5da49015339f385c890859ba73ec603a7ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962858, "uuid": "3f720b43-94b3-4682-bb63-d7eabf9231fb", "comment": "Malware payload (Prometei)", "value": "e629a77d11209e140ce71213747f3e01972410cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743962858, "uuid": "7770b83a-a462-416d-adb7-02ee089c12e6", "comment": "Malware payload (Prometei)", "value": "3927dc12acbc5f95da18a033fd219d0fd77ec2f271d2a6bcd8b3a6798b87637e4296832d9c90875b884fcdb534c98f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962858, "uuid": "c8ee2c83-8acb-4587-89b8-191ffb994de6", "value": "T1769423F8C87D2E3098169B3CBB1A826CF0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962858, "uuid": "c81fe40e-bf3d-4a18-bd6f-9aff904723ec", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743962858, "uuid": "05e7ee82-2309-4f96-a845-2db1da3fdbb0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743962858, "uuid": "b3a5a4a9-8718-467f-9038-9dac26a50b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743962858, "uuid": "58b4b34e-2881-41a7-9a50-1b7c02f04980", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802418a9-131c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743967357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967357, "uuid": "93ce6814-ac51-4571-be06-b9ab7a5f94d2", "comment": "Malware payload (Prometei)", "value": "a22726d0fb62fc840d849496a7245e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967357, "uuid": "8be2a8b8-cb9d-4971-9622-80a8bc1a257e", "comment": "Malware payload (Prometei)", "value": "82ec36fa3e960f0df6321df9ea01e5d1633897bc6b9c5d4dee2bde5100feffe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967357, "uuid": "5679b4df-7b49-410d-b06e-c38211185bed", "comment": "Malware payload (Prometei)", "value": "2569f55b74c52fe1fc2cd0a877b4661694d1ae3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743967357, "uuid": "1c6a3edd-3550-4067-a69c-eb1e844d18eb", "comment": "Malware payload (Prometei)", "value": "ccf23999718981d078223b4cc51f262e05edd193be40d5b4f745bd3a72967b363c1a223199870522413d10e41d43d12c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967357, "uuid": "9efc3b13-3a9b-4e88-bb6e-eb52ff7657be", "value": "T1C29423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967357, "uuid": "02705906-f516-4e0d-8899-3ba156b5edd4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgR:25WOSACZSV6eKRH5EPiamb4DsDwwcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743967357, "uuid": "989bfd5c-e6f9-45f6-bcdc-cd64cb5eb06d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743967357, "uuid": "db914630-d400-45ec-9b8b-946f683d5925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743967357, "uuid": "81d69ec3-6cdc-4bc3-bc3f-ed5a832977c1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda5f855-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918122, "uuid": "c6ff6f77-f71f-432d-b444-c3b49c2196b7", "comment": "Malware payload", "value": "bce8353eb21729910cab155775fbdcff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918122, "uuid": "ebff95c1-9ee5-40bf-8298-2bd6ee8cc752", "comment": "Malware payload", "value": "830e16097edf267e59733c8b6c234ae8bfd680ce7d85c00ed83ddd5e4f5fd75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918122, "uuid": "a2394f8e-5d27-4a46-97b3-d6cdd6e5ed27", "comment": "Malware payload", "value": "8dc795464836f38e6ab966c912c5393c1f09db36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918122, "uuid": "e0a61583-ab2d-4b1c-a4d7-7955ff8a64fa", "comment": "Malware payload", "value": "523f4fdd932280f805b7db43820907bd1850f2181b5db3f2c36c78615416dfbaf768e7dc90149d64bcd2f97cfd237756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918122, "uuid": "1ba56ddf-7256-47df-b1bb-711a17cfa33b", "value": "T1EDC5338DCE87DF69D3CF48746B19C778BB93210102E769C8371A450636AF96F73168A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918122, "uuid": "f0b64bca-6e2e-4e83-8773-68211c89fd2a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918122, "uuid": "40a3dbaf-1e36-421b-8912-b0fce0bf05a9", "value": "49152:xurvrfPSy3DGGaHhjlWXTbO5aJN6ojc7leGxR7AyDGb6p:xUfPx3raHOXTbO5SgycAGrsya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918122, "uuid": "3a8fd349-ea00-43de-9abf-314db47b2ff5", "value": 2508800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918122, "uuid": "f8cde25d-4bb1-4026-9c8a-ddefd927a092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918122, "uuid": "bf6d38dd-7d66-405b-8ad4-c0c91f2e0116", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9c5511-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743938575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938575, "uuid": "6faa8f23-4d7c-447d-96c9-8fd551ce62f7", "comment": "Malware payload (Prometei)", "value": "c5d3476b8c53804002894202f93b6a6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938575, "uuid": "70a2f80c-7683-4272-b0c0-655bfd2f2707", "comment": "Malware payload (Prometei)", "value": "8335d73e02eb7f7cd4e21fc2480aea4113d16a4a6b38afbad22b1e02e0cef14e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938575, "uuid": "9e469a7b-5a33-44f0-9c6c-bdba1c52e5b7", "comment": "Malware payload (Prometei)", "value": "6b438525d3e410c6f0f027f48bc59da0d23541ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938575, "uuid": "4d1a762b-dd03-4fa7-a94a-9e70419337be", "comment": "Malware payload (Prometei)", "value": "ce60dd27f5ff101158e38796795c8435af2b370194d28760e18180c1c2d36248a64ce96b403e4a67a01ed6bd1a1ff231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938575, "uuid": "6dce496f-c9ba-4510-a5d3-3e479b103ac5", "value": "T11E9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938575, "uuid": "dc6d5719-afbe-4b2b-af4c-760c09ea7334", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitga:25WOSACZSV6eKRH5EPiamb4DsDwwcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938575, "uuid": "2594c72d-5b5b-45b5-b380-5870378eb503", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938575, "uuid": "02ce7ef1-bdc0-4fa0-b3af-fa0503e704a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938575, "uuid": "582b870f-40f6-40e5-818d-ee9e0d69cfcf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8041411f-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743917965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917965, "uuid": "c690e2a1-48d4-4025-a1df-14924bde2504", "comment": "Malware payload (LummaStealer)", "value": "e910e96adc31273d236747daec374d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917965, "uuid": "74ce210f-f5ed-467d-90b4-0425c09332a6", "comment": "Malware payload (LummaStealer)", "value": "851ea5a37ccb45df35512014b87fc1fa951ab1b68931bcbf904a3e624b56de54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917965, "uuid": "14f727c5-1b39-44f0-a5e4-f5162095f883", "comment": "Malware payload (LummaStealer)", "value": "3a5d0b1f00c2b03ca5a9c3766cdd390f9c1dfdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917965, "uuid": "e78ba5be-3eed-4756-877e-4a0353a46a29", "comment": "Malware payload (LummaStealer)", "value": "d2f9e646f3c2e8e39bd6fbd3a49d8fe05fa200d8e316d71228dc975e536553e92160416abf59601895d17a8120d1cee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917965, "uuid": "782b6c11-b4d2-4589-ba5a-15b132ea980a", "value": "T1099533643C1BDF3FCA95C2B6080B4D09A36E05C98C9A9827874F6571B73F688E5674CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917965, "uuid": "d45a108d-923d-4ab5-a237-5a58957f3807", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917965, "uuid": "a0e1ae7c-7572-463b-93a1-396c757b15c7", "value": "49152:yT4z0Mp7OmXrvUdcf6ZQzqybSOtr7AmpI6kFV:yTAlOmXbfyK7/xNuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917965, "uuid": "41b097c5-9593-404c-aaee-82770453c883", "value": 1922560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917965, "uuid": "4b0a2cbe-4401-4ab4-9597-f2c660962cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917965, "uuid": "4ec6fede-73aa-43fa-b49a-8f6e64a48c4d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd69cf6-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917609, "uuid": "1c9d70c4-821e-435d-b044-cdf819002420", "comment": "Malware payload", "value": "a681b2da548c05faf4434a319834a279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917609, "uuid": "806b9e9e-107e-40ce-b7c1-9a1564347901", "comment": "Malware payload", "value": "8675abb9562cab234ae11ccdfb0cefa8f260a6f503ba63df95c7d0ffaf959948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917609, "uuid": "29758f4c-1289-4ff2-8563-735bd16d6fb3", "comment": "Malware payload", "value": "495de11dbd5e3ec8295ca7ab5679f4605b916c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917609, "uuid": "3bf0f65f-e683-4b34-b036-9902398cf53b", "comment": "Malware payload", "value": "df609f679e031365e415caa15d436571c83bb2dee21c0bb6c952c9f19c909ce052403f44591edfea43dcaa9e89bddc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917609, "uuid": "1cfaa369-3473-44e1-af43-61cc63541b2b", "value": "T13DC5332DF9E30CFBC09FC2706BA969497F96264106B8030897497CE53A07F5F6F29616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917609, "uuid": "3343ed68-6206-4ec6-b2a4-943ed1599971", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917609, "uuid": "897a7656-f0ce-47b3-ba69-ff8d77581394", "value": "49152:NFNX1ClH29wDPUu5tBuZwnaxOlpWLiGsCa6fHPbW5kr4ctcM:aWwou5iP3LimTHbm64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917609, "uuid": "5aadf57b-9635-4cda-a25d-16c28da87b92", "value": 2516480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917609, "uuid": "970c7763-6fd9-4123-9f7d-78dc463a41e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917609, "uuid": "8a75f7ce-9c0e-4b3d-bddf-46871767508f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41308883-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918289, "uuid": "64ea9ad4-40ed-4310-9b8f-7373f004587c", "comment": "Malware payload", "value": "c758286ca1bedab0fada9a7208b53ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918289, "uuid": "c24665ba-30c8-42a2-b8a7-9264e1ed972e", "comment": "Malware payload", "value": "867c237f886cd3fb6e4d980a1a4a472810d7c3a90c7ab85ae3b21bd1a7f5da94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918289, "uuid": "68143700-32a3-4389-8a9a-d073d47fc222", "comment": "Malware payload", "value": "d84408208aaa8cc03b6e2bb3745efeae04eb15eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918289, "uuid": "66ee2303-cc22-47ee-805c-d4f8dcb7b20e", "comment": "Malware payload", "value": "8e9da6073b6c5be271d62002e32f874c6d3059e959d6e11a0064c219941355ff65893a31d206661e02e5214f3613561c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918289, "uuid": "9ff7441c-bd35-4294-91e6-16d72520a1b7", "value": "T134C5334EEBA2AD7EE11ED571069B331677E9B001DBA833807716ED196A5F78E3306034", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918289, "uuid": "ef03dee9-5744-48e2-b857-e08111d1ec89", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918289, "uuid": "63a1dcd5-fa96-4e00-b4b2-b58e6fbaa921", "value": "49152:SQmfk4cnF9X+6n/HiPCFPcBUuwNzkH/mvER1wQI+0wl6X6TsMsCUey+XW4:FgcF9t/CPCZcTEcmAaT+L6X6Tbs1eyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918289, "uuid": "ec0e21fd-3c4a-4626-b014-4d6f8760f919", "value": 2536448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918289, "uuid": "5e6d56b7-aad6-445f-a559-f3f84cc56eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918289, "uuid": "e26dd034-6859-491c-83cb-fe4d411d1e6f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14740e4-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935281, "uuid": "cc8392ec-5868-4c49-960c-6610621696e3", "comment": "Malware payload (Mirai)", "value": "f853f78e9baa286b0f22f476662751ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935281, "uuid": "e82f8b86-f581-4d26-b8ed-1006e3c92016", "comment": "Malware payload (Mirai)", "value": "867cf19261e3f861f65fbe88342a8782920c25e822a8721123b4cdb0c7f62cc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935281, "uuid": "ef7569f9-6938-4d16-b587-adfa0411ea38", "comment": "Malware payload (Mirai)", "value": "541d6943f94cc98e7139be83dd60b22d536a1ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935281, "uuid": "db5ed6f1-8708-4974-93a9-0b789d8eedae", "comment": "Malware payload (Mirai)", "value": "4b9ae9cb482bf9a4cf4fa55d9db11414bbcd9001944ce7a787cda433d247f5053c12c9827fc204f1bd1de973b1d557c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935281, "uuid": "71310f33-3302-4c4c-8292-822660e801cf", "value": "T1E9432A21B63A1B17D0E0A4BE21FB4B19B2B16ADE2694C64E7D720F4FFF116406943DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935281, "uuid": "01b7b081-16a0-4467-bdff-685f2ca54bcb", "value": "1536:BFvbbqO/FjG07HBQpocnGp60ibrBu5cqlZu:bvPj360yBGc4Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935281, "uuid": "3b54b7b8-aebf-4bf0-aa4a-40339c32332b", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935281, "uuid": "ffc3b6ab-8a8c-47f0-b3a5-f92579f61b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935281, "uuid": "72071b08-c6a1-4924-b2c1-d6bd4d9334d2", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f53e62-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911821, "uuid": "942395b4-a0a9-475f-a633-ee8280e942d9", "comment": "Malware payload (Mirai)", "value": "6e16b46da71489880554caec9990e0ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911821, "uuid": "e7671067-9f43-445a-91e8-b48c36e7681e", "comment": "Malware payload (Mirai)", "value": "8768f2369693ba22183900bd02259ba37f0235920eff448a7b5479fd805a782b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911821, "uuid": "72592986-7d88-498b-adaa-9c08f439acd2", "comment": "Malware payload (Mirai)", "value": "37795cc9f69143afea5be7a8d2b7a680625dd03f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911821, "uuid": "91ffd06e-67de-48c7-9f81-fea271927414", "comment": "Malware payload (Mirai)", "value": "0d89eae2fb4a5dfd7b6a38c99d7044f9986def404135120232fe387c0eb9143fb010cd0907f51df93cd5377cc0877944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911821, "uuid": "aee2afd4-3364-4370-9ccf-d47f65b6eaa4", "value": "T102C2D6B2B7AA1F13C0A0973D95FBAB47326516E90064C34F7D650F4F6E92390A02B6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911821, "uuid": "7962083b-ce7f-4293-9fdf-41c4db0fbe49", "value": "768:Eo/k4os0BOSEEYjkbX9a/Y/wrs/jgcu9UUqmNbbcS89+:EorX07/K8S84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911821, "uuid": "10075f5a-4875-48e7-ac94-eeec79590e2b", "value": 27092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911821, "uuid": "5a95f5af-9d08-4a00-a373-bdd795d56afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911821, "uuid": "b36c1770-a80a-454a-a110-38a9625ef6e8", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab55f5d-12fe-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743954463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954463, "uuid": "ece36ad1-a39e-462a-949c-00c1c790f6d7", "comment": "Malware payload (Prometei)", "value": "07cfec4b209a112622980e4837da6a8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954463, "uuid": "3e7971db-e50c-411c-ae5b-1c6595c187e0", "comment": "Malware payload (Prometei)", "value": "87920edaede8f93d226db230930802fa81f571b7d1278d0fa5d3f103e741820d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954463, "uuid": "7f15a174-fe1b-4f65-b518-2ff22d0cc66a", "comment": "Malware payload (Prometei)", "value": "9bd6fe24225e391617a89d9836bf75849e8ac14d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954463, "uuid": "25048e51-fba0-4ca8-b5da-758b14bc4c14", "comment": "Malware payload (Prometei)", "value": "fccb68adcfe8da3d057f1bf7462983c8440e49c7cd81f7666f993964460aed72dcd01c4b6729ac845a1956689063cf22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954463, "uuid": "9a55749b-db6f-40b9-a49b-4c31d215d757", "value": "T16D9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954463, "uuid": "3dab83b7-f0be-422c-ab9e-bb4c3d0e9fd2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743954463, "uuid": "128b1c54-105e-4923-b422-1f049ab22f2e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743954463, "uuid": "d74ed1af-c837-457c-ab7b-8a3c221dabb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954463, "uuid": "ecb80e44-8f45-4f5a-9c18-a29a17c7fcb3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160a6096-12fd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743953865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953865, "uuid": "baeba0ef-30fd-4ffa-b197-76afafb15ac3", "comment": "Malware payload (Prometei)", "value": "5eb0b519e2155d92b14da43cdf381189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953865, "uuid": "a0d187f1-8be9-421f-96db-84dd305c4072", "comment": "Malware payload (Prometei)", "value": "884482b2eb9fb4e7bf564b4b2cd5b09bfb888d674656e5d7b8f2ecaaf2d9cb89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953865, "uuid": "519178a6-b835-4282-9764-133ad243464a", "comment": "Malware payload (Prometei)", "value": "5821a90d98de10a9c4b44160dfb30cd5f34aa180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953865, "uuid": "c0a47dc9-af30-4175-a1fc-f975097c3d8b", "comment": "Malware payload (Prometei)", "value": "c1bf06ee276332e972a0b825db70d05d22cdc473a6e6c312522a90759de9384629cf6be3895b6cc52b9944cccbbe53d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953865, "uuid": "4d0ade4f-4f00-4f60-ae68-b78b75b80fe5", "value": "T10A9423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953865, "uuid": "020b5a40-b3bf-43fe-b41c-75fde4162203", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgt:25WOSACZSV6eKRH5EPiamb4DsDwwcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743953865, "uuid": "b0905908-153b-4f50-8092-b4729a559cd5", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743953865, "uuid": "af3e2236-eaab-4e95-af4a-4c557024abdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953865, "uuid": "fefcdaeb-e978-46a9-9b2f-c1bbea0e8df1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd937cf-1295-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743909425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909425, "uuid": "965ba27f-2666-4877-bad2-71727e4d798b", "comment": "Malware payload (Mirai)", "value": "43b7a49952af7013461eb44429e7eeb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909425, "uuid": "bcd7e1a2-6f24-4c24-982d-95aea783e995", "comment": "Malware payload (Mirai)", "value": "886a63d03c257d22a0c05c5c16c99e6234f21a8e505eedeb708a0af559f17f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909425, "uuid": "8f81d9ea-f38e-439a-9a7d-c1c038f3e5c4", "comment": "Malware payload (Mirai)", "value": "ae241b02c8f3c6e83bbc34892de10a662efe5c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909425, "uuid": "7a8d6322-0e9b-471c-9753-a065455f6113", "comment": "Malware payload (Mirai)", "value": "24916505211eaff38e5a6936b68b6228aad21ffd0043b72da3d7aba538389a0b46191244b11dcb392d6548c57c623eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909425, "uuid": "08665eb9-b7db-4241-b196-3a6a12db228d", "value": "T1B2E3E7BFA7180383D4FB45F13D6737F98F6DADA312951289921AFA9007329B02921F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909425, "uuid": "34ddb60c-8fa9-4dff-a352-34ff1dd9d44e", "value": "3072:D7qhMqH/Vh6iupXKBrQBYTipPyDdYR4APQTagbh:D7qh1H/Vh6ieSrQyTiRyDdYR4APQTag9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743909425, "uuid": "f38248a9-bd81-4daf-9c1a-0ae5e564234e", "value": 153302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743909425, "uuid": "29094630-8086-4cd4-9df1-e6d6d13e1d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909425, "uuid": "b5d2f56c-7fab-4572-8e70-5572ffdb07d8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce73c996-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935276, "uuid": "592fb294-e3b5-4275-bead-0c62b8c78a6f", "comment": "Malware payload (Mirai)", "value": "8897230772941856a0896aa4c426bf06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935276, "uuid": "4d5cf065-b806-40fd-819d-3f541943afb9", "comment": "Malware payload (Mirai)", "value": "887496af8f94382a4fa111b5aeb95981537c12bbd68589fde3bad0a59feeb1e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935276, "uuid": "0c83ca8f-c610-497f-ab03-d624e3e895a2", "comment": "Malware payload (Mirai)", "value": "30af7501c157b183b503436bb870b61db822d4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935276, "uuid": "7edd2e69-5469-4d0a-9494-9138e328418e", "comment": "Malware payload (Mirai)", "value": "ecc9550ca402970a0a8cea58a5c4de8edc53de5818c7eb1002f9446a55f98b50d90cba53b353b41ba770b42413883ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935276, "uuid": "b8934bfd-9f44-44c3-ae2b-1de07d9096d8", "value": "T127B39DEBF2471150C86246F007CB4BED3E2322826F17C9E77C6A257969752CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935276, "uuid": "1cb1f4ec-4fd6-488c-b575-b9acab5eea0c", "value": "1536:7LXBvCBEsf6pCBg51m8+zS9u5mkgfa/LWc:7LRqBspS+1IS9u5mkgfaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935276, "uuid": "352af257-f85e-427b-a27f-a4b276e603bf", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935276, "uuid": "965b5dea-20dc-4089-a484-ac9a6b52fca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935276, "uuid": "14f2e57a-70b0-401a-8704-c01a0a9977af", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c11b2d-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917953, "uuid": "3827765d-051a-4648-bd3c-1dff3f819476", "comment": "Malware payload", "value": "cc849fcce8d147a066136141784e1f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917953, "uuid": "77935171-6f0b-4c28-a1b9-370c46ba9f7a", "comment": "Malware payload", "value": "88d93f04daf2a2ea5cc31389150ba3ccca468a2b8ef1a039abd241f0f5e3982e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917953, "uuid": "a4e938a6-6f44-44fa-b8e3-37b30fc8f695", "comment": "Malware payload", "value": "6db82b5a2667c3d972af5873a6623962991f64c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917953, "uuid": "d5c75b97-3953-4ff1-8957-b2ad7e61be6e", "comment": "Malware payload", "value": "c844a556dbb065973c39490d6aeee4f76d9337c4da81dadbbe0d535c0201074343e32ccc6fd1a1438428ce1d74001454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917953, "uuid": "cfa77a46-89f3-4136-a434-82a6170325fc", "value": "T1D2F5CF9696BD5498C9BDD1F8C517490FE3B238411330A7EF4AE08B196F3BBE16A78311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917953, "uuid": "4a829282-a7bf-4711-a5ac-c6d68d03de1c", "value": "49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7Tr+:KygOQSVpC/CHMTWk8znN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917953, "uuid": "4c6508cf-0ef4-4678-aaa5-c33c95ee2a53", "value": 3468595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917953, "uuid": "df857226-84f3-4139-b6e9-3c020b870b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917953, "uuid": "9cb8c95c-e3ff-4113-a357-038b26522043", "value": "neon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0725de1-12ef-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743948138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948138, "uuid": "b94ccdbf-f7f5-4c22-be44-4effb0e12277", "comment": "Malware payload (LummaStealer)", "value": "59570b386a22d40a6c46ccc602fad271", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948138, "uuid": "250b8dc9-20e2-4e65-8fc7-ca0c204e870a", "comment": "Malware payload (LummaStealer)", "value": "8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948138, "uuid": "cc9d6bfc-d7ac-4004-a425-7222427b684c", "comment": "Malware payload (LummaStealer)", "value": "d7dabbb59a19aebc245ba77a5d84d5bbf1ec02bf", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743948138, "uuid": "bfaf09ef-e6ae-4f9a-a579-7b7a2c8fb7bc", "comment": "Malware payload (LummaStealer)", "value": "78c1753883419866bc0b7c2ba53597f09b018e34b82b52e9dd6cc62f53189cdb3e5098c019015909c43e36e59a23e021", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948138, "uuid": "a0adfd38-5dd9-41e3-ae6e-e1a018ad2085", "value": "T138A6AF227A81C4B9C2710271796DB7BE97BDBE600F3191E363883B2D2E705C16E35A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948138, "uuid": "448f10f6-d23b-47cf-b98a-77107edb767c", "value": "fed7f0018d82c6d0f11daa2a5f600367", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948138, "uuid": "c729ac65-3a40-4940-845a-ffb7dffd1819", "value": "196608:uKYBzwtvLFGGq9Y+eKDRjzcW2RiNrXtV0IwA0Bm:YwtzFGGq9Y+nDRjzcW3xV0IwAEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743948138, "uuid": "1808658d-2c45-4bd2-97a4-4369c2c263c2", "value": 9715712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743948138, "uuid": "35836edd-8d58-4f60-8e49-c60c61b3e78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743948138, "uuid": "12cbd962-bb05-45cf-95fa-7b36ade50294", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fbed66-12f2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743949362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949362, "uuid": "f2375ddf-437d-433a-91ee-2d34eb00b7c5", "comment": "Malware payload (Prometei)", "value": "439cc33ff130c2c0147bdf16db4839c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949362, "uuid": "c178ff31-2281-40cd-bd75-8c797c9e333e", "comment": "Malware payload (Prometei)", "value": "8aeab3bc66129ad856c563f1985fe6b9cac119efc4ca0bc97aaa13041c8ab296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949362, "uuid": "4c5235ba-a498-4455-9984-028b41d1d48b", "comment": "Malware payload (Prometei)", "value": "b15062fdbb706e4d30a430cd7157c2a5e4dfa250", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743949362, "uuid": "a4d6d622-b294-45e1-8623-ec6bed447106", "comment": "Malware payload (Prometei)", "value": "e0dda293910b367909d0757eb7608afe59dc412aa027326298a05a723da958d1ba68642a61da413ccf3fcc020ae3d82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949362, "uuid": "6b4cb86a-569c-427d-8163-74999718e569", "value": "T1509423F8C83D2E3098169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949362, "uuid": "d3519e51-a772-43b6-ac3a-346077d86780", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgZ:25WOSACZSV6eKRH5EPiamb4DsDwwcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743949362, "uuid": "6c191368-e644-4b8e-b8fc-7df24d5097c3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743949362, "uuid": "5f7993b4-b109-426a-ac11-c2dea3ce11c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743949362, "uuid": "a9ea76b2-8ae6-47dd-8d78-e433656990f8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebee77c0-128d-11f0-ad17-42010a9c0004", "comment": "Malware payload (SliverFox)", "timestamp": 1743906120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906120, "uuid": "8979ce83-c6bb-478c-9228-a29052aac8dd", "comment": "Malware payload (SliverFox)", "value": "a3cad8e021ea92ca86f79496c28d67f7", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906120, "uuid": "77c7df58-aa46-4aad-a983-f2642b3c2970", "comment": "Malware payload (SliverFox)", "value": "8c0bd3d593151bd94162e95609d493ccedc723130a48f236d66fd5e887361d5d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906120, "uuid": "04d566cf-f07a-4131-967e-fbc1d9fbaa99", "comment": "Malware payload (SliverFox)", "value": "63e3e4e9fb5cb3ecb14458d5014822168c971e1f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906120, "uuid": "4cda7e9e-17c0-4356-b663-05758c5879cc", "comment": "Malware payload (SliverFox)", "value": "ff0eb529c168b9f7f2024288c9c5f7863e46262373a0246565c5232da97b2fed14e43f681ef649771477857365b57a98", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906120, "uuid": "9160d466-303f-40c5-a860-2d6c639dbad3", "value": "T19B872532C6AC246EF05AE371344614070B553A3569C8AF8B71EE1507DF1A6F339A2BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906120, "uuid": "9584b284-57c4-412a-9862-eaf804809268", "value": "764efa3dbefc54a86f3528541293cafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906120, "uuid": "db3cbed8-f320-4375-ad5c-c289ffc525f9", "value": "786432:klgsJBKmpfaDAbl6dHog/klDJ4PK9auyQvQ8cJ:klgIBFpuA0d7/wD6PKRyQvQ8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743906120, "uuid": "a903c417-e0cf-4c7c-975c-b08026b5fff2", "value": 38459043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743906120, "uuid": "05913751-a729-45e4-a056-59f58d0ff3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906120, "uuid": "c2155a7a-0de1-4541-9061-9c6c177a84cf", "value": "Installation_package1.0.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff05353e-12a7-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1743917319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917319, "uuid": "d4e5b451-c221-4e2a-8f39-83030733eb7f", "comment": "Malware payload (SnakeKeylogger)", "value": "39398a48dd94cffe3152e86051a2ffaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917319, "uuid": "35f0472c-f52d-403f-8527-9e930dcedd03", "comment": "Malware payload (SnakeKeylogger)", "value": "8c3a0f760deceeb69b81b809d2a16cb2ff5979f4b332fc4243eed61fb2111e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917319, "uuid": "d58d3957-7b44-4f25-92c2-6d5bd4f1f588", "comment": "Malware payload (SnakeKeylogger)", "value": "74583a168551c1c4d67355b680cc5f10782a3cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917319, "uuid": "6715f7da-d416-4a9b-af61-51f96be1bf0b", "comment": "Malware payload (SnakeKeylogger)", "value": "36b183198e8458c9f4e416894b9adc50dd47f863778f9e26571ed8d0db4ef632f175d668242be7822e83a57914e0ef0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917319, "uuid": "63a03ce3-3a0a-4f19-a6cc-3ebe23dcddfd", "value": "T1890512202265EC11D9A107B49C70E3FC52B89FCDBA21D3178BFFACEBBD2965528541D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917319, "uuid": "ebb3a265-ccca-417a-950f-7a235d52e8b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917319, "uuid": "716e1bb7-83d3-4787-9580-da619a3db3bf", "value": "12288:pEhRXkErogmWP9ESZVPKsG1AoAP+mb4PcGrjC/EtrB9tX6bqfzad1ERhh9cWnQ:erptaHTwmS4POSXZfiERhh9cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917319, "uuid": "be7bd112-99ef-4739-b544-275bebd7f9ea", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917319, "uuid": "bedffb3a-0b38-450b-bd6d-22185525b663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917319, "uuid": "350ae172-68ba-4a17-971a-a7c9afac6fea", "value": "Solicitud de Cotizaci\u00f3n de Desechables M\u00e9dicos para Hospital de Bolivia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a1fac5-12c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743930153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930153, "uuid": "dcdd2a18-233f-4b40-8258-7dad7ce490dd", "comment": "Malware payload (Prometei)", "value": "82487cf94836213b715ac822dfd51126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930153, "uuid": "0063d236-6df3-446a-b730-3a7df5367c27", "comment": "Malware payload (Prometei)", "value": "8ce8e6599e2fe6e3f072e72443694e3639f6ded32cffa635267f544681ec01f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930153, "uuid": "6d56d8da-2169-44f4-8c79-5812ee2a29f2", "comment": "Malware payload (Prometei)", "value": "b317d90b116e91d73d94ec814d42eca439934307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930153, "uuid": "e708ec17-adec-4f05-8e5c-4dfa3cfe763a", "comment": "Malware payload (Prometei)", "value": "b5a2abd58cec76c63b884a7027dedd36d0a9feeed1a076227c83c9bac396a20d6c0350a2c8084b82f995f80d154bc2c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930153, "uuid": "30057aa4-cb18-4cba-98f7-c2bc2c3ee2b3", "value": "T1999423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930153, "uuid": "d0749b9e-b0f8-4153-acb5-722b481f570c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743930153, "uuid": "6a1ad277-2605-4dca-a275-cef31967094e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743930153, "uuid": "b00a5949-7cdc-4da9-af2c-657c2610209d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930153, "uuid": "4ce7938c-3080-41ec-8fc8-265e31d9b469", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972afc54-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924446, "uuid": "50d7c651-0f25-46da-b57c-6355b07fe797", "comment": "Malware payload", "value": "91307836fc92abcc1548ac8a30b8a14c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924446, "uuid": "7409f92f-11eb-44df-84fd-2a660cbb96ca", "comment": "Malware payload", "value": "8dcb67a9450c4ff019068804236f377073a5d23f9c73d0c266061d7373da3560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924446, "uuid": "f90b607d-921b-45fa-a881-4f96984b5ba0", "comment": "Malware payload", "value": "bc14590b4ed57e034c9e06950e8209d87af85100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924446, "uuid": "a0249a2c-5e98-4777-9544-6a2739ad1c29", "comment": "Malware payload", "value": "41fd3c4487f0409f50893dd8a6cededf06edf230b8c4e9ada00be8613bedd62ded8c1bc8f4e2f8c8aa2b8c9d8762162e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924446, "uuid": "7ba434cf-1cb1-4dfe-bc8c-5e989850ea05", "value": "T1ABB6333747F3A66FE08F80B571D7D527B8E060BC2732A51B532F95857B32A9019AB903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924446, "uuid": "ecd41a35-cdce-4bbc-9974-9090acf69a4d", "value": "196608:VMt34LdyMmXtvEUMtlXBviLUBJZh5gZMxc1WQ/TW75I+cPA9YYh3Iasta3ksnFN2:+bMmXtMtlXBUUTT/xaTWRcI9YY6FWrSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924446, "uuid": "9de9d164-8403-4b8d-93ea-0e1a9d82a162", "value": 10698752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924446, "uuid": "8add6e12-2932-4134-8e7f-de3f27051283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924446, "uuid": "09ec3d64-9e00-48fb-8d76-b9e8a493b903", "value": "Electrum_XRP-1.5.2.AppImage", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5f2296-130b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743959858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959858, "uuid": "59d17196-0a25-4780-b5d6-e82641fe9dbc", "comment": "Malware payload (Prometei)", "value": "078eb033237d4718d3b4241a2165c5b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959858, "uuid": "f6febe18-e039-48f6-ba7f-f2face7ac35b", "comment": "Malware payload (Prometei)", "value": "8ec2bd638a5fb4ee12ea7c7db29bfbd27858d9f211d988cc83a57c5bd247a23c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959858, "uuid": "99e4cdd8-fa36-4c8a-9bf0-7434a6596008", "comment": "Malware payload (Prometei)", "value": "02d4a6ed71b22cd807e72e7d7acacb3bc3923936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959858, "uuid": "ca77c3c1-0e9f-416e-b86d-252a43835928", "comment": "Malware payload (Prometei)", "value": "1c285d0a571bb5fcfe0e5c165b8df13a784ed47f324c86471882b3431b1f1bf1d265d33f38cdb03dfb5a3f9696d1f3c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959858, "uuid": "bff11160-0735-4d6a-b9d0-92cb14352a23", "value": "T1969423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959858, "uuid": "0ecb05a9-3977-4e88-9372-5a954947271c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959858, "uuid": "1db53280-e288-488b-aa5c-fe7e28afcd9b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959858, "uuid": "a86bd4bd-ebfb-4c4d-a886-d6bca2b3987a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959858, "uuid": "4d81899b-3a50-4344-b8bb-a2e961922120", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca28e138-12ae-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743920237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920237, "uuid": "9aece7fd-f17b-4d21-8eeb-c9f0d36c5594", "comment": "Malware payload (Prometei)", "value": "553031ff63bfcd14cdd3c1a7ec1d9667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920237, "uuid": "bf180cc8-75ee-43b4-af46-ba663a406827", "comment": "Malware payload (Prometei)", "value": "8f47b4dd1d0ba6a1ac599c9557c9b54327a4369eb5a0975b9ddc6d86aedddd8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920237, "uuid": "8892f583-bbae-49ae-834f-00e1b348f11a", "comment": "Malware payload (Prometei)", "value": "f55399b7e09cc78e6526723e90e7479ba8d5b554", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920237, "uuid": "65a8fa43-7600-44bc-960e-ce575ddf0639", "comment": "Malware payload (Prometei)", "value": "5f3b7cf704eb2cb2ac770d34c1b44c976fac7b1b9d5027f33bb208736437ced347397d6820bede991996513911c1fda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920237, "uuid": "02de072d-4477-4bad-910a-d6e0566dd5db", "value": "T1A89423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920237, "uuid": "a7062524-dc31-47e0-9307-1f96d03745ea", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920237, "uuid": "7d652435-5688-4d04-ba25-f6e3609fd09c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920237, "uuid": "44c563d2-0982-4fa0-8d9d-811afe74feea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920237, "uuid": "3229aecf-9521-4e94-9d5d-ba6174be3740", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543feba1-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918321, "uuid": "a627e8f6-7713-4a81-a772-4022ddd4c729", "comment": "Malware payload (LummaStealer)", "value": "037147f19ad3415e9f40f93823006ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918321, "uuid": "c9d43d3f-f8ae-4f53-87f6-9db069e6b819", "comment": "Malware payload (LummaStealer)", "value": "9118828229db58d220432231ad1344bc922dec6d15463f1cd54567520f2ebffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918321, "uuid": "061d1ed3-da9c-4a17-8567-7fb3f98a7e1d", "comment": "Malware payload (LummaStealer)", "value": "f8aadb772e37cffa845a471f358ca871db8de0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918321, "uuid": "e517498e-a27a-4f61-9ddc-a8a1b09c9bd3", "comment": "Malware payload (LummaStealer)", "value": "890120eea3ee6fcda651d2e06224ecb8191b828dbb79204b879a85c38daa61ca22f72d2ddba727c49c0fd9a82e092a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918321, "uuid": "b04c963a-a021-4119-b2da-1ae6c5a75f3b", "value": "T1E28533656DA79BE2F42361338DB0872F87AC9548FB13991BB9AD0633502F24273FD650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918321, "uuid": "ed911ea0-1808-4766-b0cd-ede030bcccad", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918321, "uuid": "03fa9412-454d-4b47-bbfb-70e2693d086d", "value": "49152:uJWoJ/uHWFAGI/+dwP6LgEkatL2iIDG0xA:uRbI4kaEig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918321, "uuid": "535193a1-bee3-4e3d-a6a7-3f9239cc270d", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918321, "uuid": "2cfc07d8-cf74-4b42-b2f2-3fbed1feb82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918321, "uuid": "789966cf-48d3-412c-a8ea-6c8f2dcf2d80", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccbb156-130a-11f0-ad17-42010a9c0004", "comment": "Malware payload (StrelaStealer)", "timestamp": 1743959621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959621, "uuid": "737ad0cb-4867-498d-af69-33a92e6525a9", "comment": "Malware payload (StrelaStealer)", "value": "60d2c56f6442da684ca824c51a93edde", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959621, "uuid": "ad664b6a-088b-4228-a6f3-127bb25dd18c", "comment": "Malware payload (StrelaStealer)", "value": "91cdf10ed292a169e32c5df33913845eda527e9940133e894a2e0840c2499a07", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959621, "uuid": "fefd108f-de0b-405d-a264-3ac04004ede0", "comment": "Malware payload (StrelaStealer)", "value": "d1fb256e92f812773b6a018637df56e3c63891ee", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959621, "uuid": "fe91566e-2ca6-4dd4-af1b-e2fcc626266d", "comment": "Malware payload (StrelaStealer)", "value": "573477c44117980169869c9488ede32753457f6bd3e3a65cb4f102bbbe276fcfd7ce9a9f9eba4f319714e541153db9af", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959621, "uuid": "5a329849-132e-4768-ae8a-06617a9c6b3b", "value": "T1E45152061BFC5731F3BB9E710876A1104B3378A6AE01CB6D1090028D08B2F54DE29FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959621, "uuid": "11421683-ad9d-4145-b23f-66e331f5d4c2", "value": "48:86JcPMeTVdLXuHz7Jk7gF2Jqs3MBY0YW+:86JxefuTWsFCqst0b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959621, "uuid": "df8a460e-a3fa-4575-a111-c31b5125a5a2", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959621, "uuid": "d6f03ba3-e749-42dd-b9d9-6d73ee92f33b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959621, "uuid": "b4becaca-dc43-456d-9e43-4b81f27b04ee", "value": "RE_007394029384393483.pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f0a656-12de-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743940680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940680, "uuid": "5ffaba58-b93c-4638-a700-99c673623767", "comment": "Malware payload (Prometei)", "value": "81ba6b0a08ccdae49d4d76a5714b620b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940680, "uuid": "2fab2da2-9ff5-4fea-b42e-29a9f8b6c433", "comment": "Malware payload (Prometei)", "value": "9208d3481128596e098246e1153ee828cb134344e797544337d660e5c6587fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940680, "uuid": "f0d38abc-4659-45f5-b079-1575bd48585d", "comment": "Malware payload (Prometei)", "value": "7f9ce5ce4521fa21c0bc3167e47011fe7b5c269d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743940680, "uuid": "6a3dec57-78a7-4664-a13e-3db5e57de032", "comment": "Malware payload (Prometei)", "value": "50fd9b5b7f436b70ff3a65e5f352c66d5eeeb98bbbe3d740d15cf3976f4c81c450a33fe76b69d26c97e3cb5f4df1cb32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940680, "uuid": "0490d06b-f139-4175-9df8-351429b22a3f", "value": "T10A9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940680, "uuid": "5e399c69-3fb3-433e-a916-8de364c41195", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgm:25WOSACZSV6eKRH5EPiamb4DsDwwc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743940680, "uuid": "29f7d3f2-6ce5-44eb-b535-8b22e793af34", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743940680, "uuid": "80a87848-c9a4-45c1-839c-5ac6bbbf5f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743940680, "uuid": "03022813-9bc3-407e-8e38-19ee65760c85", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7733781f-1305-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743957464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743957464, "uuid": "8cb750c6-846c-4df4-b0a4-f6fceb21d8a3", "comment": "Malware payload (Prometei)", "value": "2337a0522bfca2777d5510a79c4586ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743957464, "uuid": "5d46ba45-f56a-4f81-a522-c6cf0f09bc1c", "comment": "Malware payload (Prometei)", "value": "92b3be0798d6e86e6a051f5ac47294aad8af9f61739c3319a7b2e81e818551aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743957464, "uuid": "fb8f9744-b6df-4ab6-b1b6-a5c9369e33b1", "comment": "Malware payload (Prometei)", "value": "4bef55db521f7d961db3ede655ef2dcd174aeb76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743957464, "uuid": "3c4e9dee-955d-4b9a-a4f4-f80732daed90", "comment": "Malware payload (Prometei)", "value": "47231943422b57eb3a12e58a578875812f37947c51d7384209abdc175b6677aa64b64aa18bb652a527005858d14e0ea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743957464, "uuid": "ea79781b-43af-4de7-aafd-e886459cbd01", "value": "T1169423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743957464, "uuid": "a3db9187-d39a-4cb5-b161-c898a96daffb", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743957464, "uuid": "3922e603-ee24-43c8-a2cb-50c1a5760b02", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743957464, "uuid": "cd292d65-f101-42f9-accc-16a8e486dc92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743957464, "uuid": "bb4d5b68-1cce-440e-be08-b4c8760465c2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b2ad63-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918209, "uuid": "ee53a560-2c37-435d-bd63-36e96ae7a130", "comment": "Malware payload (LummaStealer)", "value": "e79226d37e3aa14676fd0999937a9434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918209, "uuid": "959eaa08-80bc-4552-a1f4-438a2349fdf7", "comment": "Malware payload (LummaStealer)", "value": "92f333ea066465307636a6acc20e770e0b765e0f77fd4fb14a334ac565d93aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918209, "uuid": "765cb103-807b-42d1-8ccd-cf0baae3152a", "comment": "Malware payload (LummaStealer)", "value": "3863fc38995488eba05b951c4f68bccd8a327cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918209, "uuid": "19dbd1bb-9e4e-4757-bea3-7d54faef14fb", "comment": "Malware payload (LummaStealer)", "value": "ab5cc92e238f4071ef058c5694f9fdd04845b54ca8eeac09160cb7353ce6ac9043f1b2ab9ddbed259c2963a7d1590afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918209, "uuid": "14c0bda6-d369-420a-a3c4-64865dd79770", "value": "T14EA52253B5984B39C7F1E1BAF73CC68A9E38135836E147CEB18D669228C5C0E5D24E9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918209, "uuid": "f562116e-3ba3-4631-8619-427e4801637a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918209, "uuid": "536a7da1-b66d-411a-a51e-90b6aa21cc33", "value": "49152:lKXc312QLG+XrT2bHBjM6d1yxkkOhltEZNE/a6H:lKX212Iu5M6d12kkOhOG/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918209, "uuid": "a29a81ad-d8a4-46a3-8475-c5574d931348", "value": 2100736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918209, "uuid": "2b564716-420e-49d2-9f3c-5e7ca77bddb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918209, "uuid": "b17ed033-daf0-4450-9685-b8a60d8e87ae", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3569ef6-133e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743982046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982046, "uuid": "d15cdf90-e27b-41ab-992b-b9ebb8fc9cd0", "comment": "Malware payload (Prometei)", "value": "650bb0e6feb1fe1f544f4d5665e5f82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982046, "uuid": "46dfdb96-9517-4c23-9434-976beece44b0", "comment": "Malware payload (Prometei)", "value": "930cbe239497486a1edeec678a40e798dc23781d97a83e935fb3b3c246b6fdc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982046, "uuid": "d064f2a0-0bd9-4001-b58d-b111383e6bd9", "comment": "Malware payload (Prometei)", "value": "c706883204407ad8edebfdcdbd2f08ee6d494400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982046, "uuid": "69b57be3-d189-431e-b9b1-7d68309ce4f9", "comment": "Malware payload (Prometei)", "value": "cca30966e749b58dddc9fd18b3fd2c800fe6df9e94bfe9261110f2e0c5d47e20c0887330a6b5224a41957ea16b5722e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982046, "uuid": "a3d2e4a9-308d-48a9-9709-08f2d2473aa7", "value": "T1ED9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982046, "uuid": "d6176741-8308-42dd-acff-f35966fb5adb", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgm:25WOSACZSV6eKRH5EPiamb4DsDwwcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743982046, "uuid": "e99a510d-f211-4392-bb68-4f91c6c1216d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743982046, "uuid": "b13952ad-b7e9-4f12-a4f2-8690358a2838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982046, "uuid": "a6348ef2-0ec4-4f4e-b769-e8c68a769bcd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8250d54-1289-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743904315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904315, "uuid": "0bcbd453-1302-4290-a52e-3d1379ffa6f6", "comment": "Malware payload (SSHdKit)", "value": "1f6d0457ff9dd80c11aece5f12277d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904315, "uuid": "51e47745-9f36-41a5-b5d4-3bf42d3c3784", "comment": "Malware payload (SSHdKit)", "value": "934efd5fae2577be2e61009e9f57285cd1df4e60b170d97e04bb44c244c45b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904315, "uuid": "86f52505-a2fa-4b39-bfeb-fa58dee75215", "comment": "Malware payload (SSHdKit)", "value": "c7b7c5bef07c289cb44292d749cb8f64deec386c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904315, "uuid": "412e41fc-f9a0-4809-ac4b-d73f98a2db96", "comment": "Malware payload (SSHdKit)", "value": "4a32766059b7ab0658113e016771af14e17734ffad208c144241bced9411edaae5217ebc9d369ba0cd11ebebad9a327a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904315, "uuid": "0af03428-d5cd-48c0-8809-88815b056c07", "value": "T11D356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904315, "uuid": "05530a81-0b26-4e84-9185-23bbcfc773ed", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvy:00BnRED/TwOjX0a5xTdvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904315, "uuid": "d482ee7a-6108-47fe-bc41-6d8998f42dbe", "value": 1109082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904315, "uuid": "83255fde-b22f-4531-9b51-09c5d6bb4d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904315, "uuid": "ae6ca102-35ab-4fb1-840d-78421554d3f0", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fd3d67-1280-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1743900414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900414, "uuid": "bac958e9-a4a3-4b2d-a2b1-47e3226afa48", "comment": "Malware payload (Gafgyt)", "value": "9f30948680188c32fb1c4e0dfa0970ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900414, "uuid": "6c11f39d-6e20-4efa-aa3b-f28ebbe9089e", "comment": "Malware payload (Gafgyt)", "value": "940cb3335364bbfeafe52d914060b07e5a986a1b08592ebc61a7588b89b2729a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900414, "uuid": "764d99ef-cab6-4085-bcc5-089dbf6c5bdf", "comment": "Malware payload (Gafgyt)", "value": "ff3278018d90770dccb644774734132c61158064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900414, "uuid": "83e44b4e-3e2d-4e07-81ec-e654fcbd9ab1", "comment": "Malware payload (Gafgyt)", "value": "7f685f16c29da882d10c9720362d7141016787c317e47977292c46568fae75590ae77ba865a65a86518536d76bd3e0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900414, "uuid": "8242600f-464d-42bf-98fe-96293ddc83f2", "value": "T189A3F899B8519B66C5D406BFFE1F818D33231BB8E2DB3203DD186B2477CA91A0A7F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900414, "uuid": "c10283c1-edd3-4146-82c0-d1df62219430", "value": "3072:svrITaX7tqOm0E3QxirBCC2cDdd5ulEEMrhTVdr:svrITaX7tqt35sod50EEehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900414, "uuid": "609409ff-794c-4b8e-9367-ff59ed0db1e2", "value": 107272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900414, "uuid": "de1108d3-0557-4f90-bdb1-1433a7691545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900414, "uuid": "cdd73d06-d658-4fea-8937-673650f66976", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919e5047-12e2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743942476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942476, "uuid": "d95b1ac5-5216-4888-bee9-05d1c96b5b3d", "comment": "Malware payload (Prometei)", "value": "80727876430b5f315350c5e548b1676d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942476, "uuid": "dbfe29ae-f65c-4057-919c-cbc2c834b173", "comment": "Malware payload (Prometei)", "value": "97fc9e88b75f20f7535912282d62097d3bdc2d5077fa5742f395192740785ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942476, "uuid": "38bcc91a-824e-4bec-88bc-8c851b5331d4", "comment": "Malware payload (Prometei)", "value": "90223ad1e63664a666bb82eeb6b15ceeaa9e3b80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942476, "uuid": "8bd59659-edb4-4e40-a88f-ce6b84568509", "comment": "Malware payload (Prometei)", "value": "5b29ab0085f6954d34f44236ae35b524c481ad8710fd3b4b6ca819557951c2c48010fb137c98da7d65886a0ee61bbaf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942476, "uuid": "0b69408d-3eac-45f2-9d06-c16810d81f66", "value": "T1319423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942476, "uuid": "500102fa-ed13-4bf1-8c41-a08716835463", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743942476, "uuid": "297e2e9c-3a2c-4cbe-90a6-77bc65991010", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743942476, "uuid": "0d1fbf43-3069-4e37-bf1c-1ac6a51a9225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942476, "uuid": "ae40748d-156e-46ff-a894-3e52891f7ca1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d2713e-12b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743924385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924385, "uuid": "5afdec18-870d-45c9-8533-4144aba57789", "comment": "Malware payload", "value": "656fc2d011ee12b61d0e605521ce78c6", "object_relation": "md5", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924385, "uuid": "0812c2eb-9ee4-407a-9680-f3ed3b2ef382", "comment": "Malware payload", "value": "98373befd5fd24ebac29604848e15b3abe8966b2d5e83323a08247f07b5c3d6f", "object_relation": "sha256", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924385, "uuid": "0040a607-7a06-47f9-8a6e-8ec05a4685d7", "comment": "Malware payload", "value": "7ebc8e6f8755501fc170db7dba9684a8b7b3266d", "object_relation": "sha1", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924385, "uuid": "979feafb-1619-43b9-9f8c-1868979d5928", "comment": "Malware payload", "value": "6725f27264eeb3d92673218d556a1eeb4dd2bd114c1d9148e4c1825929cba4331aa49186a66d3cd4b02b546f09278d5d", "object_relation": "sha3-384", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924385, "uuid": "875d94bc-26ec-491d-8082-f3dd1bd964cc", "value": "T106C1CB1E4DA24122D636A37ADF07540AE746D8372344C684FE5C63592FB1E54C8E1EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924385, "uuid": "8e2f5fe3-d218-416c-8717-96fd661d78b2", "value": "96:P/XYBnZxLJIexaonCZBsaAhkjD8aZSRQqb8aRxA4MaeNPmltr9rsAcvJ:nYBBIexpnCZBsaAhk/8aZSRQy8aRxpM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924385, "uuid": "28a34d3c-0948-43e6-97c0-9ebc576ac6a8", "value": 6094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924385, "uuid": "09c5c382-0871-4206-b7be-adbf927243b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924385, "uuid": "9f4e1ad7-0596-4ed5-802d-577f6e85a7c5", "value": "nvidia.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a038499c-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743928756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928756, "uuid": "d85a358d-93af-4050-897e-cf5f90079268", "comment": "Malware payload", "value": "e9451ab3a4b7ff91d7e8f7d3bf0e3e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928756, "uuid": "47d06581-9300-4a65-9163-05484e797e3a", "comment": "Malware payload", "value": "98413ad2b5dc092e70dc721d732bc9946b005b2321d11194d10cc0b7f40c049a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928756, "uuid": "801cfafb-17e6-4320-b478-bb2e9045ad69", "comment": "Malware payload", "value": "a73fa7e2e8438d7b8ff935856b570e59d6ab0c74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928756, "uuid": "a0147f5b-f4ff-4257-bec9-24ce9cd9649b", "comment": "Malware payload", "value": "7260c2631b579d15037f5adaa906eaf17551fe4cf677fef686f4eedbcd67c5e15ae08df2187c417cb058b447d3017392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928756, "uuid": "c60a7a7f-9a4b-4277-ae7b-c713c91bcd98", "value": "T1C7162773830391D9867F28B2EE126D7FF5105AEC43D0692FB94408FDA765782F9A9312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928756, "uuid": "5850cbee-b788-41ee-8681-354115719391", "value": "49152:97iCeH/hJsbU5Cy8K/onXQbfJViahVrCexPBT/HKsEOaa8/6XraeZc:zeH/hGbUkusYRViahVrCTyaeZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928756, "uuid": "783c959e-a30d-434d-808f-406020d8da18", "value": 4115091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928756, "uuid": "56412c55-c7e9-4e15-97bf-ea06708dcba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928756, "uuid": "f2711a6a-1d71-4bc1-9e9a-170be361b72e", "value": "1111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab7773a-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918010, "uuid": "369d40ae-dfe9-4e33-a509-a760e3aaf5fa", "comment": "Malware payload", "value": "87c0f954fe84ec7772d0bfb47b0616d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918010, "uuid": "09e08dd2-b5bf-4e34-9c7f-87412fa44a63", "comment": "Malware payload", "value": "98892f6da9828e06c501865fedf76167729f6bf79e5d9d93ffbbfbd6ce50af65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918010, "uuid": "f2b4d817-f543-46ed-a61d-45b003a178b4", "comment": "Malware payload", "value": "611f50e12a13c3e294e52a6e0da0ca938a7f2295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918010, "uuid": "2a5ad54d-512e-4caa-b80c-f8b9dd91881d", "comment": "Malware payload", "value": "f73a8db313b80d4e63f48b7f9d58d0ae76e07ffaed4356323ec3180e87a073a83a144d10260aed89d53595695b83fe46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918010, "uuid": "3775b102-0a14-49ef-9668-63d663f4d64b", "value": "T11CF52990FADB80F5DA03187014A7E27F5B307A0A4B34DFDBDA602E17E8776A10D76619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918010, "uuid": "9edcfb52-25ce-4f7f-b8aa-ae4941f8a0f4", "value": "49152:cLg2nO20yP9WXePTq/UGO3uP9jwyruw1rBPKtz7/r4iVGMSrz1EsVMLipZCE:cLDO279WOW/ROSBKtz/VGyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918010, "uuid": "f3e1a7a9-64f0-42c6-a3f0-9cd3f25edd09", "value": 3468595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918010, "uuid": "f9afad37-16e4-469a-ae3f-f131ab8ddaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918010, "uuid": "912b2327-6541-4770-9831-510bbde940a4", "value": "quzfesaq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192b8321-131b-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743966755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743966755, "uuid": "8323e57e-ee5d-410a-a5fc-9870a77a2838", "comment": "Malware payload (SSHdKit)", "value": "270ec0477320e6263bc4ff6a81db484f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743966755, "uuid": "16241019-751b-4051-a55f-7af67d0c85b9", "comment": "Malware payload (SSHdKit)", "value": "9938efe305b1cccbcab5e72671fd904f44d0facec97f7cb721ae174c8b200ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743966755, "uuid": "b16388d0-0333-4f7d-934e-af88bc0ef733", "comment": "Malware payload (SSHdKit)", "value": "4f12af8b7ca6cbe9cdefc986e68ab3e9645f1c83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743966755, "uuid": "0a7f84fa-10bc-4c98-8b00-5e32a4345c05", "comment": "Malware payload (SSHdKit)", "value": "a8742100d90ceee043db99a7b8ec8b4f1809a004c9f85c6912d15ce0c629fbaf9d8f6a428b2b91a5f5757500bf543240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743966755, "uuid": "1267143d-392d-4236-9c82-ef65d9bd62e9", "value": "T1EA356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743966755, "uuid": "6b0e7da9-2797-4b3d-8bc3-a246b511d32e", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6BTxIVD7bLv:E8dbbsO38+TfgRiPIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743966755, "uuid": "ab623083-fe8b-4d97-a482-a9f7ec008f0a", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743966755, "uuid": "02ce9190-e3ee-4123-b21a-fea92e3dfb4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743966755, "uuid": "8a83962e-4eff-4d86-8f03-344f829bfee9", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1380ea5e-12c3-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743928950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928950, "uuid": "45e3489a-a496-4c35-b65a-e48c9305bd16", "comment": "Malware payload (SSHdKit)", "value": "3aba1d29bfc1760415461b0298bf0cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928950, "uuid": "05883206-e129-4d6d-8369-48847df29331", "comment": "Malware payload (SSHdKit)", "value": "9956911aebf03e7facdb54b95580b061c0d4aef661b2b993060643504953b617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928950, "uuid": "5b885284-be83-4e22-8942-94a73f6561a4", "comment": "Malware payload (SSHdKit)", "value": "de3d3578096ea9202edccfd9eb9b80f72620a7f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928950, "uuid": "ff73aad0-2e2b-47a5-98fe-8706d35bf1eb", "comment": "Malware payload (SSHdKit)", "value": "97c9a3e12af05fbd50e2a7111490549afefa367d40207a6c845a2ce63aee82cbe776e1c5abbf2f0147e1fd43865ed805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928950, "uuid": "20545e01-44e6-4fee-9bd1-6cbb9122f53f", "value": "T180356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928950, "uuid": "63bb54a5-6345-45ac-ac7c-ce43861b9f5b", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVr7bLv:E8dbbsO38+TfgRinIVHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928950, "uuid": "32a0ffe4-f54b-4bb8-8ed6-89117e9c1186", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928950, "uuid": "b63a528e-916f-4ddc-8b62-6eec7e78b177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928950, "uuid": "e5996c0b-62ff-421c-b45c-fdd095be5321", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ecc239-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917337, "uuid": "5742ad20-f4a3-4df1-9a6e-4fdb3a0cc9bd", "comment": "Malware payload", "value": "d185bf253c1b5105d732eff1effa3ad0", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917337, "uuid": "b71cbeb4-06cc-4be0-883e-9fee82249d1b", "comment": "Malware payload", "value": "9ad2c2e9b4c1dbc7c5ab0b0336c698051635f0afdae0231037bb9f2d1111d3f9", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917337, "uuid": "7418402e-208f-4fe8-b861-d32ac37ce78c", "comment": "Malware payload", "value": "c70d84ee0e3b36addfcf6651d9eef29d85b349a4", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917337, "uuid": "9efb0723-48dc-4abe-bdd5-8c9f511cb8e7", "comment": "Malware payload", "value": "0e223325df4428b7b21300b72e4febe795d98f7702f3fe0bcd10eb8da9fdeeef01eb87a0427c23cb67cad3f93565fc3e", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917337, "uuid": "fef2a8db-d4b9-4195-9d1f-8a3ea10dee39", "value": "T19CB092A49E2ED5A9D89262E33A6BE10CC04A001C4780E82051A08E282F21B2C0A99420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917337, "uuid": "d23b6a61-ca15-4490-820d-60e141af2fde", "value": "3:uAVGAEO9KTWX/6L6A/FbsONHnAv:PX/g6A/Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917337, "uuid": "13c49b7f-dc84-4261-b1b2-d349df49f958", "value": 116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917337, "uuid": "7d50480b-2f8c-4840-be94-50e1e703a48f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917337, "uuid": "623b4a43-be5f-4fc0-a0a4-163babe985d4", "value": "winstart.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b10fabf-127e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743899515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899515, "uuid": "25e5b570-88c8-4f21-bf9b-3739d6abbe1d", "comment": "Malware payload (Prometei)", "value": "4adeaa716e7872aaa310496bbd22603f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899515, "uuid": "3c07461b-9715-4ca3-be8f-e1768688ceb5", "comment": "Malware payload (Prometei)", "value": "9be9cdb289ad6ef932b8e40f72585be6a6ef627cbcecdc6a0790188157d8b43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899515, "uuid": "dc5dc969-9209-4c48-9398-e4da622bb866", "comment": "Malware payload (Prometei)", "value": "7dbb7ea3b6f444f835b17bc7e06c58f3d41f7747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899515, "uuid": "38e37a50-5fc5-407a-8819-71b6e620dd76", "comment": "Malware payload (Prometei)", "value": "59fc39a6b84af4888b24b23d1f34be44f3eee9748120b569005eebeab912ecb20b61a2402bc58d167a4c92f218403d2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899515, "uuid": "6ae2fa64-cb6f-44b6-b176-88b46307777d", "value": "T1379423F8C83D2E3098169B3CBB1A8268F0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899515, "uuid": "36dc635a-7bb7-4d12-b8f3-7ccb590d8c58", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgR:25WOSACZSV6eKRH5EPiamb4DsDwwch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743899515, "uuid": "573edb4b-5acf-43c6-a981-9191f5e49e34", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743899515, "uuid": "c17cf91e-3fc2-4a03-8ae3-472eec29c5f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899515, "uuid": "9d4dae64-5667-4b65-b095-a1187dabfa3b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceae405-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918228, "uuid": "16a4b3ec-4860-45ea-84c1-4fb24629ee0b", "comment": "Malware payload (LummaStealer)", "value": "829da9dd8f720d68713811c156335dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918228, "uuid": "62e908d0-2ee3-4fdb-9909-9ff236a459c3", "comment": "Malware payload (LummaStealer)", "value": "9cf2247ba59a72312403769dd918cb30aa49554fc334c4d2df51200d0bd42488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918228, "uuid": "abb57df1-6f1c-4125-ae4e-b3fb1cec3f95", "comment": "Malware payload (LummaStealer)", "value": "c511a1e4677fa886bfff1dea765ccfb8f4c83bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918228, "uuid": "5610982a-49a9-4fd0-8f6e-50b32e0151c7", "comment": "Malware payload (LummaStealer)", "value": "4f702027bd6458407d0fad6517fdbc8194fbf4151faca6f167cc4b731841162176cc889a7ef9b4880803a5f43ee563ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918228, "uuid": "9d9ef900-2e76-48f5-bd68-46593d2c60a8", "value": "T1C7A5231D5B32177FF9E2E6FB42C23671F73175C188A2D8920A24F15A884F729B39E851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918228, "uuid": "830a442b-fae4-439c-afc9-15a0e95887fc", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918228, "uuid": "732027ca-b6fa-4eae-a5b1-39b1f8136172", "value": "49152:VsKGPPY+e8safU0Bk/JN9QwLQSFgMhN99eSnpDUIcoL:VZe/FfQ/79ZLQSFBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918228, "uuid": "15a020f5-258c-462a-a5fe-e07e2ce4a6a1", "value": 2146816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918228, "uuid": "08ef9e1a-23b0-48f6-954c-3bba8175bbb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918228, "uuid": "992730d8-1336-4802-bfab-38f9a57f04e1", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7a5c72-12ed-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743946977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946977, "uuid": "52494d7b-b61a-47aa-8a6b-f58fd0a49c69", "comment": "Malware payload (SSHdKit)", "value": "83401b5f50920a81f152ac699814bad7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946977, "uuid": "40ed7116-f236-4f8e-9913-22597bc88c49", "comment": "Malware payload (SSHdKit)", "value": "9cf79f971d92fc7a0352555f5526bede1748029a3f6d943cbffb7d38bfe5cbcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946977, "uuid": "f6e73685-42ed-48a7-9a09-952a96bf812a", "comment": "Malware payload (SSHdKit)", "value": "61d715b8def89f2a4253b049afd6318078897572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946977, "uuid": "3dcd4ba3-d7a6-4d4b-9333-3faa29b31232", "comment": "Malware payload (SSHdKit)", "value": "64fcdcbdad15cb6ee08d182f862175c2c5feee4fc1006a6410d12970dc4d468dbbe4367dbf31f5ace96988980c21e6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946977, "uuid": "acda5abe-9dfc-422c-b27b-97081dec1219", "value": "T163356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946977, "uuid": "9a47e75c-f266-4599-a9d0-c544ddb5e15a", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvZ:00BnRED/TwOjX0a5xTdvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743946977, "uuid": "75764b2e-3144-4fa1-a7af-5a13b8a6b710", "value": 1109011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743946977, "uuid": "e90ee8cd-ff3a-4dd2-b5b8-635390b038f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946977, "uuid": "f1c5e096-23f1-48a9-95b9-d114e8110794", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d688ece-1282-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743901076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901076, "uuid": "14d6238e-8f8b-4c15-9383-8d11a71a5a3a", "comment": "Malware payload", "value": "cbad0712ea925e9f275408204f94be1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901076, "uuid": "0b7d9d9e-114a-4f03-8b95-eeb86566e3eb", "comment": "Malware payload", "value": "9db92a996f02448573a3ff22fee1bc63dbcb7a00cb2023a35737b901db8ed0a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901076, "uuid": "e80d468e-33f6-42a6-b1dd-e43cd22efce0", "comment": "Malware payload", "value": "e0b3809dbe921928b643a22fbc3303f57e23013c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743901076, "uuid": "b78839cc-b361-4521-b937-7d0441098a92", "comment": "Malware payload", "value": "8148765e0245ebb00b6ca2d0a6af901d85a80a2845fcce5c81ddbb55691c50e845f4daf79d2f458b7eea2c2031031936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901076, "uuid": "178c9a07-df32-44dd-ae0f-bb9bf1467597", "value": "T13FE63362D6F7D1BEEF81117BC6C8A76571CDBA642B12C00772E1062D08764E2FE35B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901076, "uuid": "cd48eb43-488f-468f-aeb5-d2a7514c08d5", "value": "e6f39b3587ab9278fb99290006fa6b09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901076, "uuid": "11a8f013-edb0-43f3-83ce-7f9fc98782c2", "value": "393216:PFjN4sc/0zEBl7pNHlqUM//BlWPkvtzHY:NhSMIv7/cbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743901076, "uuid": "8fc6093e-b0f6-4c0f-b20f-d42f7341379b", "value": 14149729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743901076, "uuid": "114b1e59-d938-4c16-9f7d-61a144a4d562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743901076, "uuid": "a148bcbf-8cce-4c88-98d9-68d7df2927f4", "value": "BrawlBox.v0.78.Hotfix.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db192d4-12a1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743914525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914525, "uuid": "263b073c-a020-4593-a4ee-b52783a780ef", "comment": "Malware payload (Prometei)", "value": "fd5576b834d5f41a1ae6172a4ab1bc63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914525, "uuid": "b657b307-8d73-4d8e-bde7-4f78ec442da3", "comment": "Malware payload (Prometei)", "value": "9e60ed39012f326f359b0b6d51e1bd365de8acbff2e7a2a2407723fb40d56450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914525, "uuid": "6e56ca1e-00c7-4b32-9c00-d1650149ae47", "comment": "Malware payload (Prometei)", "value": "07b956b0a8c7c93cdd0cac69fe86cf64abbb1b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743914525, "uuid": "39fd0592-fe16-4177-83b4-e1a8638d084a", "comment": "Malware payload (Prometei)", "value": "a6ebb0dbde5b7a9dfb3cfba73632d80e8d18b9f7b27e3cbecc932097e9e020a10e4ec0b8467d47085acc1eaff7e78633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914525, "uuid": "67302289-1a38-46cd-a85e-1835b460555a", "value": "T134155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914525, "uuid": "0545327b-f44c-4043-aee1-3f551c9da5e0", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplV:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743914525, "uuid": "f21d63c9-5849-4d40-84f1-ae9758bd1610", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743914525, "uuid": "75de02f0-bdb1-4338-8738-0d722b49d40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743914525, "uuid": "4605654e-495e-4dec-ad79-51365a9ad032", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d68e7c-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918478, "uuid": "95150be1-22ca-4a26-b8e4-36c8018297c9", "comment": "Malware payload", "value": "bb95e08c9fb8f83324aa092bff3b8b32", "object_relation": "md5", "Tag": [ { "name": "anti-analysis", "colour": "#5DE524", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake game", "colour": "#D48CC5", "exportable": true, "hide_tag": false }, { "name": "info stealer", "colour": "#5FA03D", "exportable": true, "hide_tag": false }, { "name": "Leet Stealer", "colour": "#7DD99A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918478, "uuid": "8c89c043-83e8-4f54-904f-6cae4ffb46e3", "comment": "Malware payload", "value": "9f8e42e8e10d051cee919ae77c86e8405ae98cdf191d19a2c3480480b0e79e5f", "object_relation": "sha256", "Tag": [ { "name": "anti-analysis", "colour": "#5DE524", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake game", "colour": "#D48CC5", "exportable": true, "hide_tag": false }, { "name": "info stealer", "colour": "#5FA03D", "exportable": true, "hide_tag": false }, { "name": "Leet Stealer", "colour": "#7DD99A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918478, "uuid": "c2cddca9-eb9f-4a25-b835-6f7ff6c6466b", "comment": "Malware payload", "value": "4b0a2abf24be493d46225c4e454ca22b6729c1a1", "object_relation": "sha1", "Tag": [ { "name": "anti-analysis", "colour": "#5DE524", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake game", "colour": "#D48CC5", "exportable": true, "hide_tag": false }, { "name": "info stealer", "colour": "#5FA03D", "exportable": true, "hide_tag": false }, { "name": "Leet Stealer", "colour": "#7DD99A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918478, "uuid": "05c7ee52-d223-4195-9191-950e0d95c12c", "comment": "Malware payload", "value": "f81433bcaadaf5692f0ae863753d3417991610a9b1c393e099db51bbeb649fd8a29274efb756a8967fa2677117f61a88", "object_relation": "sha3-384", "Tag": [ { "name": "anti-analysis", "colour": "#5DE524", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake game", "colour": "#D48CC5", "exportable": true, "hide_tag": false }, { "name": "info stealer", "colour": "#5FA03D", "exportable": true, "hide_tag": false }, { "name": "Leet Stealer", "colour": "#7DD99A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918478, "uuid": "3688d171-b6c0-4989-9cb9-047582aefb9e", "value": "T1ED0833A3FBD0E1BEE1259B3381F149044BA23ACE47E07102774DE1CD457AB98B53DA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918478, "uuid": "6e406829-d627-40f4-8e10-012a6cc15bec", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918478, "uuid": "cda41bc7-86cf-4e60-b88a-b79a370a1b9e", "value": "1572864:+c+e4h7TL9BHI1GwCXkUYmaBcSrufGanp7GgtcQ3AsERPqh:+Ne4N4YwCumaBcSruZkUEyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918478, "uuid": "310b4f73-118c-4f4b-b5dd-c206273b9e89", "value": 80242195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918478, "uuid": "6205eaa3-e2bb-49ff-b26f-ee534151508f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918478, "uuid": "e5e36455-a646-418e-8769-2f22e95eeb2e", "value": "NightGame Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dba39c0-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743938577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938577, "uuid": "65a53a1c-22ef-4052-be5d-4921a24a099a", "comment": "Malware payload (Prometei)", "value": "55b26f5f114d2d9781edfb98ce9b60f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938577, "uuid": "f3b3f88c-220b-4e80-bf5e-cfa18b6994e5", "comment": "Malware payload (Prometei)", "value": "a016ad1250c6ea3c1a7146540f2cf09b991b31b029d58a40dd9967a2af86fd32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938577, "uuid": "a306f2b6-2b85-47b5-babe-07188c2bb1b8", "comment": "Malware payload (Prometei)", "value": "791f79112bc4610a42df3d9d50e4de92ea0d8ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938577, "uuid": "94c5be92-8715-47a8-a59c-aee030db1abf", "comment": "Malware payload (Prometei)", "value": "4d8dfee17107808958174519e8476d6be1c0deccab1d3dc652e61812f6fa9d7ad0349cf8b40f3c17bfbd8e47941e0fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938577, "uuid": "356dc345-57c8-4929-b04e-f3648affe2ce", "value": "T1AF155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938577, "uuid": "2eee653c-1967-444a-bb5c-9fede01071e1", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplu:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938577, "uuid": "34dceac5-4dce-4eed-b8cb-0364312fffba", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938577, "uuid": "07667fa7-99d2-4062-9521-78287128d05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938577, "uuid": "8e479e0a-920d-494e-a7fd-9311d8634a82", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc0abc8-131f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743968860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968860, "uuid": "b12135bf-d7f2-4a11-9c2f-27d4f1c7355c", "comment": "Malware payload (Prometei)", "value": "4d63107ed79a4fcfae2e8113e61ab678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968860, "uuid": "4d8abab5-7ecd-417a-acd4-17a69e93ee1f", "comment": "Malware payload (Prometei)", "value": "a10f83baf8b4cac9613e0fe4b5454da46bdac311db7d793c2949caeae0f1bcaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968860, "uuid": "26035b3c-bc83-4e8f-8895-2baf16953045", "comment": "Malware payload (Prometei)", "value": "afb85e0470cb5637aa5cb3f667dc96aaaf0b2ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968860, "uuid": "137016ec-5f9e-453d-8a46-c982609ddff5", "comment": "Malware payload (Prometei)", "value": "430fbc444e11a2309e82116ea4ee417a0248b534cccac897442dedc19e23bc9c06fcca684eab021206dcff7b86d075d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968860, "uuid": "e94cfa1f-c36f-45ac-8ff3-acd2bccc7a4a", "value": "T1B99423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968860, "uuid": "ed974649-b8fe-42fd-8f4c-622085c4af3c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg3:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743968860, "uuid": "3a79b606-f13d-4e58-ba7c-b7661b8d859a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743968860, "uuid": "e63e9fda-3910-48e6-bda0-35ed3b5ed847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968860, "uuid": "a5fe1bbb-d8f5-4890-9d38-ebb83d65df45", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0f4c98-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918230, "uuid": "c98785d8-b219-4db0-8765-bb3345c931c7", "comment": "Malware payload (Amadey)", "value": "211061571cf1b60208209fa2204b3035", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918230, "uuid": "bb281cb5-328f-4d37-bc62-fbcda0eb60e5", "comment": "Malware payload (Amadey)", "value": "a13e7faae122bc102b08a43756324af72cd2bae5a5a4817f31b75a1f6fe5e170", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918230, "uuid": "0f8586cf-e7b2-4b73-80c4-8f5d9f599e07", "comment": "Malware payload (Amadey)", "value": "570b171d6cbbae798b86f664b566763be8c15e48", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918230, "uuid": "80c471db-fdea-48a1-b239-1f5885359b2a", "comment": "Malware payload (Amadey)", "value": "cca4a0edd44f47cda5efb3487d0f79dff79f2e20e6ee3934df1df5b06c0f976435daa16e24f60b7ed40929dd94d40711", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918230, "uuid": "c96c5656-7dd5-4c4b-96cc-d8dd1117e99f", "value": "T1A29533B23C513DB7D83EE27169AA7963F3C05C1B2848A7553D2AC3F58877606A61348E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918230, "uuid": "04f43b3e-3558-4ae8-998c-17390043cedc", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918230, "uuid": "2c90e087-2c67-4769-a309-c8f8c96b5ae3", "value": "24576:o54dustllVjtOxjmRclRvN3iUGb0DUSYQSoyPPMsvT+tTfLspOgGDO/P9EScJsnQ:oOdusjlp8JFSUG4AqAEt0BCzxtLej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918230, "uuid": "d5649db7-d786-4a82-bbdf-8a6b07ce84e3", "value": 1907200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918230, "uuid": "f4029786-b14d-45d3-82f5-1810207c2ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918230, "uuid": "609343ec-26da-49a3-b0a3-6a123b051924", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b116b4b-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743917984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917984, "uuid": "8fccb76c-33c4-4f01-8b02-b7e294dd7115", "comment": "Malware payload (LummaStealer)", "value": "20352d1b577cc2a3ee80d40858dd9ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917984, "uuid": "abff9f4c-047b-40e6-8183-cd26395735d7", "comment": "Malware payload (LummaStealer)", "value": "a257aab8502673465ed0b2bfc295b328f30b0997df15e08395fcc33c4381e164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917984, "uuid": "3fe072ae-3b51-407d-b310-774a89884142", "comment": "Malware payload (LummaStealer)", "value": "be014e04e714f320a74723071607574951814e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917984, "uuid": "34d86a17-5565-41d2-9b62-f04917091b4e", "comment": "Malware payload (LummaStealer)", "value": "43e09c8f09d1b411b8502f7bfe56918b8858bc83c6d1cf76c2e73ae960a4887c0a499071bb58074230f06a7ea5bd9e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917984, "uuid": "83ad24f6-a221-4b8b-bae4-24d3da38fabf", "value": "T14DA523CBF8C522A9C631E635E4434E36D47597FEFA8791F4DE0C03DAB92181C3142AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917984, "uuid": "26e9356d-6627-40ed-97cf-fc56dfe7689e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917984, "uuid": "0691b104-a7f6-429d-9912-2a60725d75cd", "value": "49152:zFg3EQF6oTxiGDDXmWJuw0soB9/rLW236LhHZablj:zFYEuxiqm2uf/AxZablj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917984, "uuid": "768a1a0c-caf8-4226-8d97-407f63fd3a2f", "value": 2063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917984, "uuid": "0710e032-f1be-46f2-82cf-41a19643fa2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917984, "uuid": "a03df60e-55e5-48a0-9957-1c88cdabd05c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09359ad0-1342-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743983479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743983479, "uuid": "e66f34d1-4652-4111-95d2-68e5fa50b7df", "comment": "Malware payload", "value": "eca2ccd75638470aa004394ba0ce7556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743983479, "uuid": "e2b595d1-004f-4dcb-a474-1b37e70a7c81", "comment": "Malware payload", "value": "a31907ef7aa827efdcfc036f0c4640b6a6bbfdd1e0f6a3a63056ce6c0d73c3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743983479, "uuid": "7d8c0376-67ec-4499-851e-56ca1ce26f66", "comment": "Malware payload", "value": "2c38dd2e0a3dae6b40fb5381b8cbe6a9375271ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743983479, "uuid": "c18d4874-2593-4d54-9da0-e6a91fff13c6", "comment": "Malware payload", "value": "9cdc80d29a145f9712e7c144b2917fb2159fd962ab6fca8364589b7072ab3afbe3b23f191307464ed3692fc9090b8593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743983479, "uuid": "6ddc25f1-9ac4-4c5f-88ef-97df805b404b", "value": "T138D41224FAA2C428D347E1FB76F3A588ED14BD8D1902EA16EF133A3E46B45059DF8147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743983479, "uuid": "13263cbc-939d-4c38-a1c7-a140d3fb4347", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743983479, "uuid": "b3e948db-b5e3-4a88-8925-78f265889ba1", "value": "12288:ctoOoZHdIAQR5HyY2Q5XjxjLGYknelYJArEhpLBC/nlVUAV2M3j9RXRnX2o7:NOojcL2Q5Xj1LvkneqJ+4BC/lZV20HXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743983479, "uuid": "6ffdc405-971f-401d-9b6a-c421c3822d6e", "value": 597915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743983479, "uuid": "fc7b9b7a-9415-49e1-b505-bf5ff10e0ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743983479, "uuid": "c3b6c864-5e6a-430f-bc9c-b3fab44ad843", "value": "payee Advice Dated 07-April-2025_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86474733-1315-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743964361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743964361, "uuid": "d18aad89-a0d2-4eda-bb9c-d255eadc92ad", "comment": "Malware payload (Prometei)", "value": "757a8c884ee944b8db3a053fd91d44d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743964361, "uuid": "2df38289-ca7b-4562-9342-6f0d3d5fb7dc", "comment": "Malware payload (Prometei)", "value": "a338230fad814b31848b0cae0289c03fc4ceda09a91c4d8e7300d051dea5df38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743964361, "uuid": "390ad3f1-0c25-4f76-b88f-614a7c8f1f05", "comment": "Malware payload (Prometei)", "value": "96259abd11a24b88e32f4433e08fce67460a31e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743964361, "uuid": "c18db62c-c1f3-4983-9a61-1ede958150e0", "comment": "Malware payload (Prometei)", "value": "db78f3901b31252a7a4d64a3b66dc2ee28254532975302a6685d3d17a1874e285fad889259984afb51f813651d5cd498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743964361, "uuid": "d990acb1-784f-4585-aa42-e3057cffe03f", "value": "T124155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743964361, "uuid": "3d7f230b-bea3-4e45-8e86-6e7f667af010", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplv:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743964361, "uuid": "32db0eb9-0f02-4f32-9d1f-bf093b683fc7", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743964361, "uuid": "4498f798-c9a6-44b9-a973-bd353659a1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743964361, "uuid": "216742b9-f9c9-4e25-801e-0402442e7e2b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f06553b-12e0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743941532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941532, "uuid": "94e03379-9f2d-49bb-a43a-1efec0cb35c6", "comment": "Malware payload", "value": "25a1b69aa52789c8cd44e85b8ef9b306", "object_relation": "md5", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941532, "uuid": "5294e411-3eae-404a-a563-7247c4b713c8", "comment": "Malware payload", "value": "a397c1287257d89d680f3f507e3b065c5071d11a16fba03a9ee555859c71aaaf", "object_relation": "sha256", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941532, "uuid": "8612a408-ae1c-4fec-90c6-47a565160187", "comment": "Malware payload", "value": "d8de37587039c1488363675ea582b384834a8c59", "object_relation": "sha1", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941532, "uuid": "eddaa8c3-0424-45a7-aa50-dfac5a98b9bf", "comment": "Malware payload", "value": "0fc1d756c0439d2ba5c37077de21449dd62a255e00ec3ca35c2bc0ddd77d14ac96cd18407a05fb41769a4dcfa34e524b", "object_relation": "sha3-384", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941532, "uuid": "5fcec57a-7525-415e-8324-0fc54ec76c2d", "value": "T18F17338DF5460CDEEC82C102AF2E7D3F455F243896DE2568747CFA40385ABD8B7588A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941532, "uuid": "2fe8132c-0277-4dad-8c78-97b2d7b1c643", "value": "393216:1GU4dS1+MCxBY12qOFn/1hz7VwxbsVPPPLOHoAoIgokF93kKCuMXQ:1GKnCA7OFn/PLHA+L9ZMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743941532, "uuid": "3eb3850f-a20a-4178-9848-69611afd5b63", "value": 19648998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743941532, "uuid": "c9e6ee47-6c07-42f6-ad00-33eb1ecabe2f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941532, "uuid": "a6d197cf-9b71-4c6c-898b-f580d8984d83", "value": "\u0417\u0430\u043b\u0438\u0448\u043a\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0456\u0437\u043e\u0432\u0430\u043d\u043e\u0433\u043e \u043f\u043e\u0441\u0442\u0430\u0447\u0430\u043d\u043d\u044f \u043d\u0430 26.03.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6fc9d7-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1743939055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939055, "uuid": "4bce6a0f-5919-453d-bf26-f1b7fdca8ce5", "comment": "Malware payload (CredentialFlusher)", "value": "1596b6c6f6d3398becb33bd515c94764", "object_relation": "md5", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939055, "uuid": "f0487d69-a33b-4a42-a597-cd140c112b5d", "comment": "Malware payload (CredentialFlusher)", "value": "a4653feb7d69867b2ade3ea80ab37386591b875742d054675a54ea9e622cdd46", "object_relation": "sha256", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939055, "uuid": "8fb14b94-e703-4cdc-bace-642432714338", "comment": "Malware payload (CredentialFlusher)", "value": "30c34c202a50031bc3a3efc7bd3a2508fbf66318", "object_relation": "sha1", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939055, "uuid": "e8376ec7-634c-4a9f-8bfe-46fa3050e85f", "comment": "Malware payload (CredentialFlusher)", "value": "d5d27f4575205d66d8fc6496800c982052e21a88796686fc1408f98405109e25db473aa5d9d9ff3e2e96eb06f701fc15", "object_relation": "sha3-384", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939055, "uuid": "b04d5e71-1151-46b8-b0e6-f5941392ab7b", "value": "T1FE259E0273D1C062FF9B92334B5AF6515BBC69260123E62F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939055, "uuid": "34893946-8208-4590-9c80-701aaf7cf9b7", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939055, "uuid": "15193aa1-8a88-4eb3-bc54-5518503d3255", "value": "24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8aGVde2:gTvC/MTQYxsWR7aG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939055, "uuid": "55aca1a4-344e-45b7-9681-fe3177e1be8f", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939055, "uuid": "be51e26d-acb5-423f-9972-6fb83e4058d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939055, "uuid": "fbc0e819-742f-41ae-913e-76410f860f0f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd1d9de-1313-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743963464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963464, "uuid": "b1a340fd-4b13-4aa4-bc0d-2e9a99bae38b", "comment": "Malware payload (Prometei)", "value": "b9f7f281d78d5e22a2b0bfa0ee83e29c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963464, "uuid": "475124d4-0afe-43a9-83fa-18a030f30df1", "comment": "Malware payload (Prometei)", "value": "a5cc7074ff50fce1d7b1e07cc90780646facee8f5861886f0ec4f568cc928a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963464, "uuid": "5fe20ce6-df62-4009-92a6-9a8b32eaa22e", "comment": "Malware payload (Prometei)", "value": "15c0818e45e92c5ac6774f6cd7f0e5c57e86eb4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963464, "uuid": "57290545-7051-4006-9d9f-bf193d80998b", "comment": "Malware payload (Prometei)", "value": "17059f6dec280c0ab57773bee56a6aedf2ad015a80987945aa1e35928ea2709cbe4d400e3a7aed59ea08f70cf0d540c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963464, "uuid": "7c485b28-4eec-499b-8397-274d333ec99e", "value": "T1869423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963464, "uuid": "d58c8a37-a7d7-44b2-988b-fb7416ba4977", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg1:25WOSACZSV6eKRH5EPiamb4DsDwwcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743963464, "uuid": "ac04b15f-0b36-4763-a2fe-24193b4f3286", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743963464, "uuid": "9f9170eb-97c0-4496-89a4-1c7a06343a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963464, "uuid": "800b5492-f06e-4b7d-a8ac-55557fd51020", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369e492e-12f8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743951772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951772, "uuid": "6481d49d-7c29-4164-81f2-97ea9f111252", "comment": "Malware payload (Prometei)", "value": "b71cb3abf1c2cf27cf6d8877c5b95bd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951772, "uuid": "89eff28f-a35b-4c86-90c2-dfd871863911", "comment": "Malware payload (Prometei)", "value": "a5d767bf5da55f595a9256785593cee47ce1f6df774515a58ea9ef1d9d11c907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951772, "uuid": "9d316d3f-e49d-450d-bb35-a7e1e2639626", "comment": "Malware payload (Prometei)", "value": "e5def282558bdbc0b15fe65147e14d75177b39b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951772, "uuid": "e5a6204f-41eb-420d-a2f5-dbfffb6c8c3c", "comment": "Malware payload (Prometei)", "value": "1819b0c5585baf945a0dbad1d624b6933286cb51b84838819df82f09212e3bfa58ad215bbe25bb4cb2c7195b5545e494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951772, "uuid": "aa749686-4f21-4653-aa42-328d3290e4fd", "value": "T12A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951772, "uuid": "847e15c8-141e-4b27-b53c-1068ed5d0c46", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplp:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743951772, "uuid": "7f97946c-533c-46b9-907c-e13ad909c901", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743951772, "uuid": "46dd1a8b-8a5b-4c54-b045-c16bdd98e34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951772, "uuid": "b2d043ca-b06a-4c51-a36a-6e55730705d6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdac0fa8-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935275, "uuid": "118a1db7-bdf0-42ff-affd-f887882734c3", "comment": "Malware payload (Mirai)", "value": "5cd45c63e73fcf6ce32c4b2e19fa0503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935275, "uuid": "f23d0951-d45f-4d3f-ada5-f1fcb077869a", "comment": "Malware payload (Mirai)", "value": "a72b43a1a32359b5c3a511e202abe39c5a9f108a88bbadf50c829f9103695887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935275, "uuid": "ff6dd46f-2ffe-47b7-a9ae-0ebcbee2ec5e", "comment": "Malware payload (Mirai)", "value": "83f8576861845895af32f0fb44cc102702fc5e06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935275, "uuid": "32c4c77e-8342-435d-bd13-f0ea69af95ab", "comment": "Malware payload (Mirai)", "value": "31d257aeff52b01d451f4814786a385f7efbd91e9fc89276deab1253e6cf4044b0f96b145b4a1cb5ca2a406acb1780d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935275, "uuid": "45ed1be2-be5f-4eaa-8fd2-636f79f4810d", "value": "T1DAA2D065E6A42DDEEEFFECB07D62C3D137618F4FA3408F91248CA711642686E67009D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935275, "uuid": "467f05dd-ed72-4aa8-8c82-ee0dd535df55", "value": "384:+htZnV1uwezSqiT2RyjJnT8rM5VL2qaMohWF4pPA8jiM4uVcqgw05VxJmM:MnDuZOpT5jaM/vaZhWFqVN4uVcqgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935275, "uuid": "b01d319e-512e-46d5-bda2-78dab6d05187", "value": 22284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935275, "uuid": "257bcb6b-d315-4cf1-af03-a65db06f9449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935275, "uuid": "c912b9e8-9ed6-47ca-8335-db9db5ecdd95", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bda128-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1743918292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918292, "uuid": "06bd474f-a22f-4388-8d5f-e599e96f3af4", "comment": "Malware payload (Vidar)", "value": "2903d41ad464d10bc7e58c066a07287c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918292, "uuid": "0a1ea691-f504-44c2-91c6-c2775fca50ab", "comment": "Malware payload (Vidar)", "value": "a7b371eda0aae2bfd49e552d0abf4c70304569b585f11f09908f7abb12834969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918292, "uuid": "7bf998f7-c3a3-4be6-bcbc-677293164474", "comment": "Malware payload (Vidar)", "value": "482fe777804a6b447e71a842101673fd074f84c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918292, "uuid": "0a4ec9f9-df89-4cd3-991f-a49c3b470f9c", "comment": "Malware payload (Vidar)", "value": "bc937b5f6c244a73a3e419026b34547d4fb240eac95c475a6e593a135b76b1938af931490da2e82c6f819fde509f9422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918292, "uuid": "4d451686-8bab-430d-9a8e-05327bc684b7", "value": "T11715BF14AD7990DAFCD340B17759A2217433BD378F385EEF40E48369194ADED0A3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918292, "uuid": "1c3e3024-d117-4ef1-984e-a0b48f240bb7", "value": "3a5649d16d788396ce56dd8cdabd426f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918292, "uuid": "38a279cf-dbce-4f96-aed9-4e64f4674274", "value": "12288:dt4H/IiZEu96gtZHe3ZStnAO/K/BWE92IsJpfe1p0Qh+Keey3Unu:n4HgiyW6cRe30ZD/K/GCp3hwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918292, "uuid": "f824a087-32df-4d3b-8729-98f28c27e9e2", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918292, "uuid": "8f4e5b80-5321-457b-86d9-1336bd7ab1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918292, "uuid": "7a13a9f7-d041-48c6-a45f-e30519975650", "value": "TbV75ZR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31470c97-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743911820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911820, "uuid": "e96bc395-7a12-4cd1-a8a9-f59cf0e5ca89", "comment": "Malware payload (Prometei)", "value": "124c6e5251396f2e67f17d018ec84b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911820, "uuid": "ca071b6d-b35f-47da-9eee-8cd7a814465d", "comment": "Malware payload (Prometei)", "value": "a7f9710c277b662d05a1f8db487892503596cc0df9c6d25ac243dfd8a5998bb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911820, "uuid": "9f38e012-4573-4174-90b6-066042027ef5", "comment": "Malware payload (Prometei)", "value": "e71665e93ff14d0559f89a3a1a2b61ba0e8f18cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911820, "uuid": "4e4e18f2-6302-4d67-9893-1c880d39450c", "comment": "Malware payload (Prometei)", "value": "a67566154598adfcea7646f12ad2b9811f9877caf12c440e1d2464a91760ca0d06800e757d27889ff53dcebced012a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911820, "uuid": "78b8c0a1-960e-42ef-abcd-f0365db226e9", "value": "T1E09423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911820, "uuid": "fb4bd60f-fdfb-4ade-ad73-b10ff29d61ad", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911820, "uuid": "b51f8064-e7aa-47a2-84e0-6697c9b2e431", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911820, "uuid": "f83c9540-e123-4d1c-a3b4-532bcd780da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911820, "uuid": "02237598-a0c6-4a5d-9458-b0a38e00e2a3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29854e90-12c7-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743930705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930705, "uuid": "6455d7d7-0a39-4a87-98d2-d785b4aaf49e", "comment": "Malware payload", "value": "6c5057bec73e60fc7d455288aec103a0", "object_relation": "md5", "Tag": [ { "name": "b64embeddedmedia", "colour": "#9F9B74", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930705, "uuid": "e29d307e-5e48-4fa7-84da-c0d2d53ac0af", "comment": "Malware payload", "value": "a82575c346be9f46572cf81c0f5b2d9d2b449b01087b6491602910b4c2172a5c", "object_relation": "sha256", "Tag": [ { "name": "b64embeddedmedia", "colour": "#9F9B74", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930705, "uuid": "5300598c-18e0-4e3e-b3c7-3edec09cf0c9", "comment": "Malware payload", "value": "21410385803fb6c44096b60f33044480fc1f82fb", "object_relation": "sha1", "Tag": [ { "name": "b64embeddedmedia", "colour": "#9F9B74", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930705, "uuid": "9e8550f0-0553-4283-b4ae-0329587ed065", "comment": "Malware payload", "value": "749094b1fea90dc2b6ebab4cb99536a1c7633714b4cfd7ef1ab19320090f9e64b36103d9ac17d104e04fd0b1a9645067", "object_relation": "sha3-384", "Tag": [ { "name": "b64embeddedmedia", "colour": "#9F9B74", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930705, "uuid": "01a84991-705b-4923-8dc6-507108b825ce", "value": "T107214410773AE6A743D34253B49DEA008E301569B447F730E3FD8209429F9D6A2AF1B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930705, "uuid": "74e25e56-884b-4226-bddf-0692e5a3ce45", "value": "24:AC+rrYa6uPDmdgaImGT5MbFG2Lw1adnMJ8oyNH+JBQuHR0KC2c02xrsWwIYO:AC+Xh7aImEAFGH1adnMuurQuHR03vaWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743930705, "uuid": "65bac081-a855-495b-bfd5-0da848b49b8c", "value": 1151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743930705, "uuid": "6688a5a2-1743-4b62-8539-03a50ecbbeb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930705, "uuid": "4725a235-96ec-4b7b-874c-3c4baa4b0d8a", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae68f7d-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915433, "uuid": "2b6e6230-7d97-46b0-bf01-ea6e239b0af7", "comment": "Malware payload (Mirai)", "value": "fab4e93bde0022a4e4af952a882efe31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915433, "uuid": "10da69f8-2076-46e1-a7a7-89a12fb6628e", "comment": "Malware payload (Mirai)", "value": "a8a7fa69b6de4d3f4b5c4b2f18ae6b61b19b0a1a3808c37756884f31543f1434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915433, "uuid": "51eda7d4-168a-4aea-b4d7-b0e47aa2fe3f", "comment": "Malware payload (Mirai)", "value": "cbd630371b2c5223d9fb3f814bed0d992d3922e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915433, "uuid": "e9c34a2b-c7cc-4a36-b75e-e6db5268f12b", "comment": "Malware payload (Mirai)", "value": "eeb57c255cc47c4001f4aeb805244dd2f2571985ee5b8991b0b1264ccbf13fed2354033c52039cf42ff74e1f92eea794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915433, "uuid": "b3c755a0-cd80-4a41-9efb-11de94250e66", "value": "T1E31318C4F553D9F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915433, "uuid": "540cfdd1-f0db-4ce3-a76f-d6f983e8f1bf", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz0q8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeYWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915433, "uuid": "2577a4ff-2a11-4b9f-8473-5cd6eb5c197e", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915433, "uuid": "4f16b507-466c-4ac7-a134-92b098b500f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915433, "uuid": "a9c568c1-8724-4b4f-b5ee-6e8b795d9ae9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ff40f1-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917978, "uuid": "30ef75b3-7247-4cdc-aa79-04e198fcba0b", "comment": "Malware payload", "value": "b940f05d81529870b84e38aca47acb7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917978, "uuid": "21cce86f-4546-479d-ba44-a1e923129341", "comment": "Malware payload", "value": "a95834c7a3597ae361b21b0028341a586bd173089679ac8775a89aaa98bde291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917978, "uuid": "3fbcbee8-d1d4-47f3-b5ba-c819fa12cf0c", "comment": "Malware payload", "value": "f9635e888d84238ee55a484953f98d806f97f31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917978, "uuid": "d8fe6f34-9c0f-41d3-aafa-17e544628e6c", "comment": "Malware payload", "value": "1644fc459344f8a687b7f1db1544872fc40a857898cab4037de882cc7a1cd9683e4160738cca660917f2e24d2d9d241d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917978, "uuid": "8fc34596-6289-4201-8a0b-c76afc3b2133", "value": "T18AB5334EDB628DA6CD9F907193BA9D6AF2539518C2D36E7C0B8E0076B253607738F344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917978, "uuid": "21def626-d980-4a25-87fe-35e769cf7021", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917978, "uuid": "31761234-8581-453d-8aed-4dbe05d5cf4c", "value": "49152:U17Go9R7uLMhdlgGPiMEGM9XjkOAKd8t2KMh3Ka49Y6L/c4PKCD:UNaMhlEjkOAKdXxKa49Y6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917978, "uuid": "2eada0ce-8157-4d1e-847f-e14284f76b8e", "value": 2472960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917978, "uuid": "6e4b13ab-3978-4175-8864-b9eec1c9d991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917978, "uuid": "8c8a6d8c-90a7-40bf-8f7f-05c5cffc1f0b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737a1ba6-130a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743959605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959605, "uuid": "d0b8cdd5-84b7-4305-9bbb-ca573b8eea2b", "comment": "Malware payload", "value": "8d9160ef47d85cada032c9f2e8d1a2f8", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959605, "uuid": "19badc26-9b06-4702-97e4-056b7f750117", "comment": "Malware payload", "value": "a96666193f74a4cc5fb0631243f8d2c686ff759afbbc0a2daab86d662e0d9a57", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959605, "uuid": "f461069f-f084-4e4a-90cd-33d09bdbb3eb", "comment": "Malware payload", "value": "f113e10e002e461976f9af631654ca823f3e297d", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959605, "uuid": "c5354005-b425-475e-8c9b-109e5bd1cb24", "comment": "Malware payload", "value": "77c60b796d308d653dc5d5f482ecea98e6f519d0fbbff3378d291eb6c647e1ccc48a94c2883e01b11b749f4784bf9467", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959605, "uuid": "2e4457e5-b2f2-46da-a5e5-9f8f9e74041c", "value": "T166E0CD019D2EC9821C77E6618735DD1CFB54F20740E4D88577CC6E5F6B76AD5064216C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959605, "uuid": "59722091-2a27-4f6b-8bb8-6e986131408e", "value": "6:TMVBd/6nXT+q9NqhdF4lRF9bdF/z7fBhSGmN5L2pyfRH5zMeq:TMHdCXaqahH4lRFVL1XmnL2ARZzMeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959605, "uuid": "77f5b3a8-4b36-4b19-a3f6-956c3ff7e1ec", "value": 323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959605, "uuid": "3cf6a286-bb13-438f-aac8-c689c08bdc30", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959605, "uuid": "23ae8803-375a-40be-b21d-1f9b0cfd2c1e", "value": "RE_00834473899387474.pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f72b98-12e2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743942243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942243, "uuid": "73b3b60e-5494-41cc-b3ab-da9ccb1c97f3", "comment": "Malware payload (LummaStealer)", "value": "2c0b48a6978d44072f598059ff0e57a9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-110659", "colour": "#0D1095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942243, "uuid": "ff1737fc-9e95-4f92-a131-61b76754f587", "comment": "Malware payload (LummaStealer)", "value": "a9b6aaaea37305c58e2076e65663542c0506ff4440a0fdec32e7ac618d6d4ef1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-110659", "colour": "#0D1095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942243, "uuid": "431b9a4b-6e7a-44cb-add1-9bb54e2e985d", "comment": "Malware payload (LummaStealer)", "value": "635ccecf70b98caed86b682e18fbe3118e4d2bd2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-110659", "colour": "#0D1095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942243, "uuid": "d6a5af6a-0e27-4d0a-805f-1fa71303135e", "comment": "Malware payload (LummaStealer)", "value": "2f317f278b4a524d771666f3c46c48b3a88f9d64fe8329935c1bb9977bb5977e4154f4a6c8e8bf51a66b2ae9079bc570", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-110659", "colour": "#0D1095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942243, "uuid": "5d473383-cb3d-4821-9873-7c6bbbd36af2", "value": "T1EE2633D59A1777F60D05E20A04511E0CE8F2A4FB2BC9687CF6E990D1AB303FC97D4AA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942243, "uuid": "30d2bb98-ee1a-4a96-8ecc-fcfe6eafde58", "value": "98304:sgU9xA//x0jxdAMy4yliQ65RdwYPGjDoiJLW06YMApyly52GHgmJkDCf:Hs8ejHfy4iiZ5ROiGIIW06YM78kGHgfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743942243, "uuid": "3db7f625-cf46-4eb5-acc5-8a166e3f76a2", "value": 4733019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743942243, "uuid": "ee8b6515-0cda-4351-827d-fb1e24f4c252", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942243, "uuid": "8c26ba04-db04-45e1-ab0f-1a0f3d30c3b1", "value": "\u00abF\u00eeleReadyPassW\u00d6rdIs__110659\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df78f7df-12e1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743942177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942177, "uuid": "254f9bdd-05f6-4790-9d96-8dd8b011f232", "comment": "Malware payload (Prometei)", "value": "fdd4f1f91e46caf6fc84e1ef5257db3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942177, "uuid": "d47d0738-5ccd-48f1-8dcf-b0b6659b6e90", "comment": "Malware payload (Prometei)", "value": "aa9d2b78efb467a0747f3d72d5f448bfc0d8d66e6835ce19c4205c865dfa031d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942177, "uuid": "d1020593-64a7-44b1-9cbb-4807489e5efe", "comment": "Malware payload (Prometei)", "value": "9450bee4660a96cadea83e97aba2fb78f6cb34e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743942177, "uuid": "fac82341-dd7e-4710-ae96-57fb505cc9d6", "comment": "Malware payload (Prometei)", "value": "32df1658f4ba6615a2a4eed15d83a237ba35c30b3865b2be288a5c6840b0f5e8d321b7318d603c7385fcb2347545dcfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942177, "uuid": "5500b581-0331-40b0-9d56-0b6af8665dd7", "value": "T1E99423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942177, "uuid": "8a42a4e6-a3d8-4ff2-bfe9-e05118783823", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgG:25WOSACZSV6eKRH5EPiamb4DsDwwcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743942177, "uuid": "34ed6d9b-d0cf-4ea8-be45-e90276ec61e4", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743942177, "uuid": "050244d4-8a74-4d5c-bba6-4e35daa29fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743942177, "uuid": "752e0dd8-9a31-4891-baeb-622a85e0463d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a678aa7e-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918030, "uuid": "79593016-a8e9-414d-9de4-afe3e3ebb353", "comment": "Malware payload (Amadey)", "value": "a03b5636d1daacae9bcd45997bb159ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918030, "uuid": "58f9d76f-2482-484b-b6bd-b42abfe445dc", "comment": "Malware payload (Amadey)", "value": "aab84eedf7b54cc93e6b39511f8b12f1885949871be86e9140f257c82bebd824", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918030, "uuid": "450471bb-3290-43ee-a5b2-946bd8c1b4bc", "comment": "Malware payload (Amadey)", "value": "bc01e15a9951f627a209e7cb274d840cf2468011", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918030, "uuid": "8e7709d6-6a96-4857-977c-02f4f4108bb1", "comment": "Malware payload (Amadey)", "value": "61e30787c3404f34604f7623bb56535e214a5c1294333968574782ac52845829697b950d8b144fb209dec400efe0b229", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918030, "uuid": "5195f982-617b-47eb-b4eb-7bd580c05cd2", "value": "T182563353DAF444E6F43B06F360A592431633BC747E22C8665B7CDD268C71452AEB2BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918030, "uuid": "1d4d3ff4-ab89-4c7c-b4a4-f8076d30509e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918030, "uuid": "6649fcac-fa2d-45de-a053-34f84a2e66fe", "value": "98304:9qXtZGYdWhusPOXy51r9Po2pJZdU+EfVaGVN0k1r1KWOGWd9ifm639SQcRchPp:81WeXK9PHFeJkk1r1KlH9if3ZqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918030, "uuid": "8c7f11b0-c5d7-44a4-8bf4-af2005cec94f", "value": 6456320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918030, "uuid": "e09eee26-c340-4818-8543-3f0d4993af32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918030, "uuid": "104a3fc1-9327-43e4-80ce-aa7f7ebc42a4", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d379622c-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935285, "uuid": "8b43e07f-6f40-41e2-888e-009ca7f5e05f", "comment": "Malware payload (Mirai)", "value": "bd492c5e6994e1401b5e066a27de7ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935285, "uuid": "25045054-0119-4b4f-b3ea-62c336b1c8a8", "comment": "Malware payload (Mirai)", "value": "abad190da0e594a129a6da0350042367715812246fc8d9838e890ebdfa393dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935285, "uuid": "b5d24780-5f8c-4781-af28-85a2fdb8dd9d", "comment": "Malware payload (Mirai)", "value": "fa60f6216209017fed9d588df953791f52f3fff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935285, "uuid": "4e1a6f80-63e8-44c4-adcf-01cf7236afb3", "comment": "Malware payload (Mirai)", "value": "d47350595f43db356c7d4f3d9aa62694b3206059737ae3a47310de9bc42dadf261291047413b3091e4191e61dd3f8b0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935285, "uuid": "fc301dc9-c810-45c3-95c7-e1c23c465187", "value": "T103430A9AF802AD3CF90FE6BD541A0E0DB92177C152834B2757A7FDE36C721A85D12D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935285, "uuid": "faf8b821-fe5c-44a2-b03e-98c45210fa29", "value": "768:MxxeBk+QxjoJex2LYkAturJpTX8Z6MCiwz/i3bhXOW8niiZPGp:Marex0YkAturJxX8Z6Mm/i3bhXD8ibp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935285, "uuid": "0217c379-2a1e-4165-aa0b-c960e323433b", "value": 55756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935285, "uuid": "a22314c6-1823-4d54-8a09-36edc5e2abf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935285, "uuid": "ef858ca9-2095-4a4c-8f06-c500cdf3fe3f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d693946a-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918110, "uuid": "b0108ac1-6cf9-4a84-88b7-f4bddea9a77c", "comment": "Malware payload", "value": "2d3913e437b87f3cd7398721c6a024a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918110, "uuid": "9ba4adb1-497a-445c-bbeb-73da75de9fff", "comment": "Malware payload", "value": "abbc78c16dc3ab442516dc515aa0225ef14107faf03d10b691850532c219f2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918110, "uuid": "58ee4034-ea1b-473f-a88c-076c71e99a0a", "comment": "Malware payload", "value": "ec9901ed42223e36fa28a1104aacda33bd0d09be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918110, "uuid": "fdb5c66f-d204-4afb-9f11-be11d975e2d8", "comment": "Malware payload", "value": "4f115e3adc9e8edf5efc4fbc9a9c530ce2a7508f093728166f4315e064be2d0ccd9beb8f1eda47a9a7c6e2995d5b056a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918110, "uuid": "e9a0e515-45d8-49a6-9e7c-04dad69e017b", "value": "T1DAF533414DE75D6A62706772EFD07A0CAFA722584A5014AE771B5FAF2B03E0EF81C64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918110, "uuid": "50cb482a-6ac1-43a0-96cf-549d12449158", "value": "98304:SaBCZwNZbJRa6YuWjsnxks5HqRhzYc/D2iBU:SaMwP3YuWwxks5HQD2iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918110, "uuid": "2529b7f9-a039-49a2-9252-f74aeab40fbe", "value": 3444387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918110, "uuid": "42b2d4e9-4db7-4a3a-96db-bd3feb9fb236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918110, "uuid": "4231b6d7-7d81-436f-826c-67313bd3f3ab", "value": "v_dolg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1054e17-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915443, "uuid": "8e5ad4c7-8ef9-49a4-b953-784c8f70e7db", "comment": "Malware payload (Mirai)", "value": "94a02c4aab4c82d11a35f3a29861c2db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915443, "uuid": "a74f3632-4057-4fd4-826e-87cd1b3b97b4", "comment": "Malware payload (Mirai)", "value": "ac8ce3dbf3a015c0ec2f95c71beec305e07bda98285306eb3df16b20f4e2bd52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915443, "uuid": "6aea6d0a-524b-4223-a3c2-2412655ef516", "comment": "Malware payload (Mirai)", "value": "5ba91b63fd78b90642bb667791f56f546063a532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915443, "uuid": "5e4b367d-494b-41fb-8507-feb0db7d928a", "comment": "Malware payload (Mirai)", "value": "a13366536c2045d3b23c8d907c87f55dc06c5b7d32cf8b86395fa48ef1f80d3aed4a3a7e5d1e2366c938995c5fdd062d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915443, "uuid": "1ec156de-22fd-4f18-92cf-ae4d92866e04", "value": "T1DD231841B8818613C6E4137AB66E46CE3B2563E8E2DFB3179D221F503B9682F0C67F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915443, "uuid": "4a7d8a3e-91e9-4404-bd96-b1fba2fbc958", "value": "768:hRT38FvJsOvEZU3JyvqKVtn9K6/8axU/PoV1K3/N+WzHn533LEw:P38Fv+Ovo089wl/V3XBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915443, "uuid": "2f8a48d4-915d-4227-bee0-904a30ee03b5", "value": 46868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915443, "uuid": "e5a50a6e-0854-43db-8fea-5bccd264052f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915443, "uuid": "2f42e2f3-33cc-4cc6-b6ae-826016afee59", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb83d41b-12c5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743930091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930091, "uuid": "cd194af1-b7f4-4690-b457-f90ee1a06753", "comment": "Malware payload", "value": "bdea1609bd3fdb97b8b8ec6d810e5a22", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930091, "uuid": "1c420413-1d83-4176-b816-52b65bcf6b1e", "comment": "Malware payload", "value": "aca8d4b7c9f20bf0a6ddcd5d0b69b0bc2965c1a334dc956e2fa8cf9ada87399d", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930091, "uuid": "32bf77ac-54fe-430a-99fa-6105803c7354", "comment": "Malware payload", "value": "c98a144eb97dc602fce50676a60c767efa23e0a0", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743930091, "uuid": "c188c22d-a6c0-4f4d-bd7c-28448b4beb51", "comment": "Malware payload", "value": "6045e750cac535a09c6a846582286d237939466f2f6f17b5ee888fc314f83c91ab7559d8ae7817f546801cf1d02bfa82", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930091, "uuid": "b1a8ac78-74da-4edd-922e-19bbf4c3880e", "value": "T11B12F1DD13FC47150F9360E4198E487C3A8DE825791CF125D889676BA6C82EACAFCB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930091, "uuid": "f89d0260-510c-485a-a516-296016c69389", "value": "192:wwSwypgehH7y3EFWDgDdiDKHzsjafRWKf5mpsXD2vJDvl2U0u:Rq3bBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743930091, "uuid": "e14b8286-ba12-49af-94bb-8db4c390075c", "value": 9027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743930091, "uuid": "28ccbc7e-35fc-4d3c-aa10-dc39aa37b5ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743930091, "uuid": "f1057b9f-ebf5-4459-9c22-1aa3ce43711a", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8f432a-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (BlackShades)", "timestamp": 1743917367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917367, "uuid": "b2be6824-867d-4030-b5dd-c07d5cf591f8", "comment": "Malware payload (BlackShades)", "value": "b4d6e360106a621bf3100d3e6284d0ac", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917367, "uuid": "7950de60-f9fb-437d-a7fe-814bb1deb343", "comment": "Malware payload (BlackShades)", "value": "acae2eb792f7d641ffa6b0fb92e885db935307ba0dba00afe113b78a9c1d267f", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917367, "uuid": "3c5cc900-9e2e-4424-b3a3-7925721f2659", "comment": "Malware payload (BlackShades)", "value": "e7397fcb622c15f6c3d7b0d6636ab2c5f3849420", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917367, "uuid": "f61c37da-a157-4e32-8972-2d571fe6479f", "comment": "Malware payload (BlackShades)", "value": "1a6aa92f7825d11265818cef36990c376be98cefdee267e9e64a44be924e3237de0d7f927530982c78a8f7c1ce83ecb8", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917367, "uuid": "bb6313fd-61f4-438e-8753-77f467a4f00f", "value": "T1FAA6EE4177FA12A27AF30F0A457D356A5A3E3E060EBBC26D682244995E77D84CCB0773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917367, "uuid": "6e6c5642-b042-4d6f-9dad-e8d8ca86a99b", "value": "384:5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5VpV5Vpj:6QCO5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917367, "uuid": "4c4ba9e7-5472-496a-877b-17dd0e17ad09", "value": 9630496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917367, "uuid": "b6905e0c-e3e1-4777-9008-07631f7d8fde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917367, "uuid": "b662fee4-259b-49f5-9482-6437a963ace1", "value": "PENDING ORDER ON TAS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb2fcb2-12e8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743945182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945182, "uuid": "65e48fd9-590c-42cd-a0b9-f854eacd82fa", "comment": "Malware payload (Prometei)", "value": "3551cb3b2459e9f8dfb0bdcf4101824e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945182, "uuid": "2d0d1816-958c-4b80-bf84-46b792b1ff27", "comment": "Malware payload (Prometei)", "value": "acd1c96443c6999456a7377c9d02dec9dd1873772eed557d2da68457ff648430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945182, "uuid": "faa3ef12-4bcf-42eb-8ff6-ce67dd309a77", "comment": "Malware payload (Prometei)", "value": "4c22f14f8f9022796c76341bcfac2816746e8f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743945182, "uuid": "50e90572-1125-43e4-aef4-d5d0870b1d36", "comment": "Malware payload (Prometei)", "value": "cb16878aecced43ffcb619d3fccbee99f6e4c38d1ffc9c43abb78813602a778046d293f501f4449c54994a50fcac7045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945182, "uuid": "b80a6dea-f88a-41a8-b823-b3d89af4f6c5", "value": "T19A9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945182, "uuid": "db7cae47-0f74-4c72-9a31-c0729a5f60af", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743945182, "uuid": "30346a2a-2073-4691-8d14-109d81a692d2", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743945182, "uuid": "2dfe792f-0ade-4160-b173-0db4e6bfd310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743945182, "uuid": "60007c6b-192d-44d1-aed7-deffe75d98bf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc57bc50-128d-11f0-ad17-42010a9c0004", "comment": "Malware payload (SliverFox)", "timestamp": 1743906040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906040, "uuid": "17bdbe03-a527-4e41-a462-1722f4787c28", "comment": "Malware payload (SliverFox)", "value": "9b0b3d2028019e33a35c7b30496e18eb", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906040, "uuid": "43d976f6-f9b0-48d9-8bcb-47cb471ef396", "comment": "Malware payload (SliverFox)", "value": "ad3f565a76a5902510efab9edc6c53905a43a762c6d47e0b7f11ac6a76c01daf", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906040, "uuid": "383ade92-ecfc-4528-b3a4-f849f23b386a", "comment": "Malware payload (SliverFox)", "value": "beb56fd74306d773230c6368b9cbeccf519590ea", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743906040, "uuid": "61961b93-a78e-4cdd-9c39-7be54ecc481c", "comment": "Malware payload (SliverFox)", "value": "cba2838cb8f7475ccdae41d3114c07e4dfd5fa2b9e5630d79137150e18f0a3ad5056b73cebd36d1bbf6cd1bb4db1a1d1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906040, "uuid": "aef5b7f0-f8ef-4731-b30e-c96e35588ace", "value": "T11FD7AF4D73F14CBAD863D179CA928A96D6B238054774C35F1361CB6BDF23391A93A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906040, "uuid": "d4d186d9-26a8-4fa1-92e2-846c86d49467", "value": "8b0b370f45b3ac947d3db16eb318ddd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906040, "uuid": "978c3ee1-0af9-46f6-a19f-a91ebd17cf75", "value": "6144:NjhCBGzuYUJJN/RjYNcFfihgMqM4649Jelo4ENdQwUto/InV6s:wGzuv3YNccOjM46gSRkaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743906040, "uuid": "d846788a-5229-4e88-b745-10c69bc9809a", "value": 62794240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743906040, "uuid": "0d8ff484-dd06-4203-a7b8-6e34ceb1b10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743906040, "uuid": "e27f2322-7337-4b77-aef2-9bfb710e882d", "value": "AOKok.07193.01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc0b65b-1299-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911220, "uuid": "851c5e80-5082-412e-8287-b7c71d004f56", "comment": "Malware payload (Mirai)", "value": "6682276051dadb08f262d854cd4f0662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911220, "uuid": "91cab7a3-e508-4cdb-8c93-2c88e10ffcb2", "comment": "Malware payload (Mirai)", "value": "ade4782a706e63627f2d1201ec550916371a68f11f6e60656583386cfda8b2e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911220, "uuid": "702e6041-007e-4f01-92ae-47a8f224e61d", "comment": "Malware payload (Mirai)", "value": "88b59d98f87c2dfb505ca1f9815800b68f1875ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911220, "uuid": "45bf8b42-76cd-4988-8258-f7ddaafcb008", "comment": "Malware payload (Mirai)", "value": "f01badc31439b8691208d6bb1913b40bd8dd043ca5896288619a2c27635e3cd8098e7eb31e788c7b825ecf5a87ff7fca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911220, "uuid": "59e7fe8b-9bf6-4aaf-84c6-50411dbc9a0c", "value": "T147E3293372D189ABC09312B82ADBA6A19C21FDBF0735614B33D47E687B398C45D59B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911220, "uuid": "4cf73cf2-6e4d-4bf8-a58f-9f39667682f4", "value": "3072:ezwFzskMXc8TfskyCBkIOVPem4MSR6WZ/DA6Dcoixgr1TkM3Q:eGMXxJyCbOIdP3Dcoixgr1TkM3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911220, "uuid": "4983b06c-9164-43ec-92c3-dc5e38b844fa", "value": 143548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911220, "uuid": "4075cbd4-2cbb-4bbe-a371-0eb866176598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911220, "uuid": "0091c632-b169-4693-8aa0-988bdd719fc4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b4bde0-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918318, "uuid": "966cb503-9b3a-4bd9-8c78-246d56c35c1f", "comment": "Malware payload (LummaStealer)", "value": "8c1dafe2efe9c9e2b704caa4cf7f3f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918318, "uuid": "bc421f9b-96e7-4f3f-b6da-d1c9d001ff99", "comment": "Malware payload (LummaStealer)", "value": "aeb5b82718869cf37959a85c9448906527619d3bed34c89647ed4f04c92df493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918318, "uuid": "094b0566-4305-48ed-bae2-3601766806b3", "comment": "Malware payload (LummaStealer)", "value": "cf2656949ea02bfecfa37578ee71539cdc9ea7b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918318, "uuid": "aaa16a26-ee36-4a84-aef7-d6e13ccfebb7", "comment": "Malware payload (LummaStealer)", "value": "46d5f39c0198306ed2024b86e9f60f1f308250c5be136dc813dc7159af5e2fc332bc4f28dc7c76353d738b84b8d376ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918318, "uuid": "322bf41b-5501-4178-a3b6-0271c391b45d", "value": "T19985336E9ABB5736EFC140B6445281547CF139B452F3A89CB31C1077A4A76AC8C8DB3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918318, "uuid": "600a3896-4974-4c52-9b57-1b3758dacc11", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918318, "uuid": "6c2e7132-4d68-49db-bd74-e5b1aaac9104", "value": "49152:NaaREPPRBNnuRQZFABcwwsZlej5KC2pV5Sady6M:EpIQZFWLwsO4C2p31M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918318, "uuid": "ee3abd11-3de1-4fc6-a6c2-9e71df9968f5", "value": 1854464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918318, "uuid": "8afb0fa8-f734-4dd3-942c-45f943fafdec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918318, "uuid": "75fc9141-9a12-4d6c-bbf4-5eba07c6e210", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc31cb8-12fb-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743953151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953151, "uuid": "c338820c-e375-4352-91a7-c4581d716991", "comment": "Malware payload", "value": "95e6091a36b2353c889ef4ca1e18cc36", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953151, "uuid": "de1cbfb0-18b7-4442-a1aa-8ef6c7cab121", "comment": "Malware payload", "value": "afa5b858f85e1357e0669d92e584465784f48c774f31d002258333778b9eb303", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953151, "uuid": "43a91947-3879-4473-bd4f-0a5196b02060", "comment": "Malware payload", "value": "9f5e93ad560225d34836e309f4abc694ff80bde8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953151, "uuid": "d906d5a2-327e-4ea0-907e-ba935d21fb48", "comment": "Malware payload", "value": "235d08a7611ddc0b265cecd911678b606d2ed813c1536d46ccd18594161099f070b83df371766d7e7f7c02a34cde50e5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953151, "uuid": "d1ecd46e-2b7a-4a3d-8ba4-ba9b26554f45", "value": "T1AAE109778922FD6A9B7B7DC0C8403E021C6CA51BA324C76CFE8D14E664E7644CF528B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953151, "uuid": "2230797b-6fd6-4bee-ab6c-e978067391a6", "value": "96:YzOnJK+TVPXgZYBEPplOnRKkswdkYv659ixl7JgPOlBTSwhAssukeFTrFijtS:YzOnJtT1XfSrOnRKYo5sB1lhhsukA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743953151, "uuid": "03e61536-6136-4cc4-9297-03473909e517", "value": 7065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743953151, "uuid": "fea66c4c-2485-48cb-bf6f-f6e25735993f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953151, "uuid": "460753f7-7fcf-4f48-91ef-93671e7706ef", "value": "95e6091a36b2353c889ef4ca1e18cc36.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b305b2-1309-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743959255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959255, "uuid": "b04f07d7-a0c0-48b2-9e99-4777706cb7fa", "comment": "Malware payload (Prometei)", "value": "9f343f6b7e369382a94a07c0bf3873ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959255, "uuid": "360c8f51-a98d-493c-9936-be56e146e4d4", "comment": "Malware payload (Prometei)", "value": "b02ee0de8096f065cbc1dbb390cbb2994bed9d560f96b37d0a8cb0469662788f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959255, "uuid": "b0e3d527-06ad-4f42-96d4-bfc22721d453", "comment": "Malware payload (Prometei)", "value": "f3ee15f6366a53c0e33de368d3856292642ebf90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743959255, "uuid": "d1199fb4-b1cf-413e-b487-100e74969d67", "comment": "Malware payload (Prometei)", "value": "112b4e5480c47fc4d6b6a170b2934c06db04ef61522e44e1bba1411ee1d190f94d2090973df257c392e864f979813fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959255, "uuid": "d68a97f5-d396-4f6e-b3a3-3a3dace43761", "value": "T10A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959255, "uuid": "ee5b8d6a-f430-43f0-976d-e6a8d51e6d37", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplj:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743959255, "uuid": "6f837d11-2dbd-4101-9c3b-e512351933d3", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743959255, "uuid": "8ba6fe27-438e-4747-bee3-21d87b7b2551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743959255, "uuid": "d963cf7e-0c5a-408e-aa6e-b0adbca6bc90", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb050f25-12a7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743917286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917286, "uuid": "5d1144ee-bbb7-4c75-b258-e2589c751718", "comment": "Malware payload (Amadey)", "value": "2a829feb8b9ef127ffc852ea0d080380", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917286, "uuid": "fc8064fe-4924-47c0-b621-0bddde15d543", "comment": "Malware payload (Amadey)", "value": "b0fcf464be88356967f96cb348590d95c44de70522b008df482f7cdf9b4310de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917286, "uuid": "e31eb054-c5fa-4503-9168-59899f7009ed", "comment": "Malware payload (Amadey)", "value": "bc4ba0c82efada0f76dcc53fb904d57bbcffe446", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917286, "uuid": "aaff31e4-0654-423d-a684-9a8d710abd56", "comment": "Malware payload (Amadey)", "value": "5da75ea04c3d39af13ed8f07018c5c937cc8bc038106cd711d560ee95e9e3e6c9571908f5629072ca57b231c0620b83b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917286, "uuid": "3f64f457-2859-4971-9088-b6c82a62a8bb", "value": "T1689533655A866EB4FC5D4C778ECF1D16AF658AD40F88174F3B3A63ABCA242CD1198330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917286, "uuid": "e8d14901-b89b-4296-bff6-c8b1d2f7da6f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917286, "uuid": "8a73eb8e-a27f-46c6-b908-e83a5bc49684", "value": "49152:1Lo06Ey/k01CobA9DBA5n1iXDHuVN9B8g:1Lo07y/k01q12Z8XDHuVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917286, "uuid": "958b7b5f-815c-4311-bbba-fa58f0474348", "value": 1946112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917286, "uuid": "933ed267-b2ae-49aa-8f52-1a47562925da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917286, "uuid": "6317891f-46d1-4cab-8af7-0ee3a013dd02", "value": "2a829feb8b9ef127ffc852ea0d080380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50386db9-1281-11f0-ad17-42010a9c0004", "comment": "Malware payload (DBatLoader)", "timestamp": 1743900705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900705, "uuid": "8d1b20fb-4c12-459d-85d8-cc4bed3b0f04", "comment": "Malware payload (DBatLoader)", "value": "f4c606b673ce10e50bb2afd3827af969", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900705, "uuid": "cf7312ed-860b-4a37-908f-8b0520d4e15c", "comment": "Malware payload (DBatLoader)", "value": "b1307013eb250074ccebf0e314c1e64046124e30cf2bbff1243b46a95a427616", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900705, "uuid": "86ce52f0-1090-4ec3-ade0-375499890e84", "comment": "Malware payload (DBatLoader)", "value": "4806f99cac84703c793891e1a1d84330159ca314", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900705, "uuid": "431272c1-8580-428a-8fdf-29a63f41add7", "comment": "Malware payload (DBatLoader)", "value": "fb21bdbf2d776fd9670a259c3e5a1d42a20145ce0547640f906beef13ce3b1e999ecc71c5549d71efa0cda992e914b0a", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900705, "uuid": "0be0c900-177c-404f-a64b-9f7f464dd7ab", "value": "T1C0A63361A3825235F8295D318D5FD031DF399DA02DE59B9F6CF8FB5E0A7418028BB782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900705, "uuid": "093d77e0-a17a-452c-b83e-e2dbae4185ff", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900705, "uuid": "c5b4d97d-14a1-4c16-9bf0-b70c4806ebd7", "value": "196608:rkNGX41zpWiG51FZkr8Vf09Z2uuVP2fJyy1uz3c:ruVpoLFZkpCTofwE0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900705, "uuid": "fe4aaef9-4e32-42ca-b2e0-cf7d92ea66e3", "value": 10374016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900705, "uuid": "1c4a2da5-2b68-45af-953a-f6c613cbca1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900705, "uuid": "f6375f8c-3238-4360-8a6e-df28f4449936", "value": "UltraOptimizerSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed336de-127f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743900112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900112, "uuid": "50d46705-423c-4212-b057-66431c55b44b", "comment": "Malware payload (Prometei)", "value": "22a91426e3be662c6e6feedc96d7f97d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900112, "uuid": "e4a615ca-857d-4fcb-8861-a5f542b95f46", "comment": "Malware payload (Prometei)", "value": "b1bca4a322dbeca6ab4f56f56222578b34510d5f7831c34b4774ec8078851ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900112, "uuid": "b9150f7a-c1da-4250-aee4-c96abc0c2eff", "comment": "Malware payload (Prometei)", "value": "729c2d3c9687d98b4f7cb5ca502ad1d8a5327d64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743900112, "uuid": "adfb6fa2-74cd-4b6e-8106-68b8883ca855", "comment": "Malware payload (Prometei)", "value": "365fe9947111c717a3a49131359934697f34d53d331ef21ac34ccdef0cd3ae26f3e3c8a72de982adf7d1c2c2585374df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900112, "uuid": "4233b393-3012-4c73-9a3d-92904942d986", "value": "T16A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900112, "uuid": "7adc619c-a582-4869-9032-599fa983033f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplW:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743900112, "uuid": "65900821-1cbb-41bf-aa4c-aba4136b0ebd", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743900112, "uuid": "f74f961e-63f2-470e-b2ad-8436ea0c0ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743900112, "uuid": "5d5d6b40-b759-4230-985b-43fa11d79c03", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdd6837-127e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743899517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899517, "uuid": "381a4729-d0c9-471f-96cc-81a810950921", "comment": "Malware payload (Prometei)", "value": "7627c988d94e1126e4d1fa953d853ab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899517, "uuid": "58ec1e54-5fa6-427c-bd9f-387a16fbf564", "comment": "Malware payload (Prometei)", "value": "b1cd9c6a5e00a074243405285edadffd6f5f7e1d99829b69ce573ef5df749a2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899517, "uuid": "d2b96cf6-81dd-4749-a3e8-25ef42ed8a6d", "comment": "Malware payload (Prometei)", "value": "38fb2e9b93b81c1480b6c211ded2134f5c8e44b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743899517, "uuid": "e6e381d0-c11b-4c41-b575-d795b2a50f2b", "comment": "Malware payload (Prometei)", "value": "4139c2bcf17567e4eb1e2367cd45dc064d2663b0fa3fcb63df621147a0ca918016d1c9904cfbf14e704ab7b5cbed75d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899517, "uuid": "aca63195-9dc5-4a21-997e-a587d6deafe3", "value": "T1FC9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899517, "uuid": "03d9e194-63fc-4971-824a-f8d35b6d1149", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgq:25WOSACZSV6eKRH5EPiamb4DsDwwc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743899517, "uuid": "f1fa9a8f-f109-4cf6-9804-86f139b439c0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743899517, "uuid": "93f7402a-5b60-4d5e-8d2e-3ce76e39159b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743899517, "uuid": "e3e91519-7fe4-4971-8613-67c8905890a1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4e176e-12e4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743943378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943378, "uuid": "31e50e5f-3ca4-4bc2-9cfd-68eeae7408a0", "comment": "Malware payload (Prometei)", "value": "eec86043918cbaf203f7807aa824d17f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943378, "uuid": "fa4cd387-fcef-450d-85e1-10c3154476c4", "comment": "Malware payload (Prometei)", "value": "b20e02f3b3e1b7c9c290104c6e4e76ff9fa44ba759143cac53e62bab970fcd3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943378, "uuid": "2ac00ce6-c041-4801-a662-dd04f6f11739", "comment": "Malware payload (Prometei)", "value": "3f946abe17a2bb52f4484e4d90d5f09066008ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943378, "uuid": "67a4477d-58c0-4ae6-a4f8-eca419305db0", "comment": "Malware payload (Prometei)", "value": "b58270f9f23d3f0d7690e064ed1600bcb55ca28f9cd2310162ca307a67f452a9390758eccb08ace02fb6d3e66bf89475", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943378, "uuid": "d5f35bc4-5136-4fc9-8c6a-ee1225700d8e", "value": "T135155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943378, "uuid": "45db7250-e552-4e33-97cb-ccabe2fda1ad", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl6:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743943378, "uuid": "984c989e-802a-4dc5-aff1-39d6dada2316", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743943378, "uuid": "b1c145cd-9e97-453e-9162-868dd9b98af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943378, "uuid": "3ea8db8c-598c-4560-b58a-d92934253044", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0767eca-1337-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743979062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979062, "uuid": "7e093d86-c607-47ae-a934-14155f90c7f4", "comment": "Malware payload (Prometei)", "value": "58be1be7481e1afe39202a671059b807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979062, "uuid": "7cf4e506-26db-4a04-9d9b-4f612c28d1b5", "comment": "Malware payload (Prometei)", "value": "b38d0e446d3515179c17c39200d5cc9441c5a69782057926c8bbe891eb2e62d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979062, "uuid": "41ed4dad-082d-4fbe-8b68-8a296dd4d99f", "comment": "Malware payload (Prometei)", "value": "51bf109ec899f587054252f95d36a1c4d1cff260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979062, "uuid": "b5abbcfa-b272-4e0e-993a-0f08fbf920e2", "comment": "Malware payload (Prometei)", "value": "dbf9b33692511519feaa6691a2a71c580f25ebe22c7b4382f072a5571044b182c587b8390de2f6508a365b5f23a0ab20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979062, "uuid": "7831cc33-ee6f-4434-8af6-88c5e8ee7c21", "value": "T1DE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979062, "uuid": "504605e7-d508-4207-91d5-4f8b25ded461", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplg:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743979062, "uuid": "a48fbaab-5f5a-4088-9126-caa4cc50c20e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743979062, "uuid": "931a5922-052a-4c05-ae24-3e842632ca14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979062, "uuid": "65b50711-c637-4e76-aa75-c89d1d2c4450", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c71d6f-128c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743905519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905519, "uuid": "716b21ba-0864-4453-8069-f65825716348", "comment": "Malware payload (Prometei)", "value": "cec79dce8ce6201c33336ccc40659d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905519, "uuid": "9f289b07-e1a4-4fdc-80d5-8aaf151a8a97", "comment": "Malware payload (Prometei)", "value": "b433c34d142014f8b8220e3364c8a87eacb84ed111bceaf9808050ef0c15cb38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905519, "uuid": "d12bd5aa-b597-4dc9-a1d9-47efea38ae53", "comment": "Malware payload (Prometei)", "value": "25c8bbf8a678e859a3030c9f8d3f05812bbd050d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905519, "uuid": "6e79deb7-8dbe-4b38-b914-94fff51aead2", "comment": "Malware payload (Prometei)", "value": "227143ff39f207b92ab1f0a239e89397e77ed6fc6e89312acb8aae2d022593a735f6945f3c519c841d0a590a00c554bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905519, "uuid": "5fe8b5a1-005c-4ad8-8b16-112416dbb8f1", "value": "T161155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905519, "uuid": "abe9840a-8939-44fc-ad24-094ab305fc51", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpll:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743905519, "uuid": "93bf3b9c-1875-4366-ab35-07a1d26aeb3e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743905519, "uuid": "811af09e-21cc-4991-8d78-5a4d64c6b711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905519, "uuid": "5e565d66-fa6d-4b44-8c57-cf71b974271a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5859e3b6-132f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743975451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743975451, "uuid": "5e6d2993-90fd-47a7-b75d-9b47a66ff2b0", "comment": "Malware payload (Prometei)", "value": "5d842e8e4a37cefddb331b38318a0dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743975451, "uuid": "9d9922d6-9504-4d56-8025-2c65604e2608", "comment": "Malware payload (Prometei)", "value": "b4c4408d5a421aa8eb2dab130eaca92d2257d4180723c2f1b5eab9316ce29b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743975451, "uuid": "8ccd46ab-2528-49e9-bddd-3311042677c0", "comment": "Malware payload (Prometei)", "value": "05ee84003978f512946a7331b9f8a0962ff68ed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743975451, "uuid": "44e96c45-5f83-4cf7-8da1-de6d0787255b", "comment": "Malware payload (Prometei)", "value": "0e3c96a7842a2a66b47d328486533c1caaef58c6e5f6b6481cfdcc23dce0d5f5611fb187a2585f9edc96c0c17fdb3b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743975451, "uuid": "74cd7ad0-631d-467b-8a42-6be909f18978", "value": "T1E8155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743975451, "uuid": "8518d411-36be-4fad-937e-34ad36594003", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplR:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743975451, "uuid": "895bc10b-2c5a-4685-b2ad-85c50d0687d5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743975451, "uuid": "5c40039f-0de3-45a5-afca-6e6e8d569c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743975451, "uuid": "e93e8abe-b3d7-4ff3-bed3-a433909abe3d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61980f3-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920633, "uuid": "d2d8f15f-f4e4-4515-91c3-214f1ae929fe", "comment": "Malware payload (LummaStealer)", "value": "bc46237c0ee35460cef7da8ec65440f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920633, "uuid": "67136b51-56ee-4fa9-98bf-66cae6d5daf4", "comment": "Malware payload (LummaStealer)", "value": "b506e7fefab2f19cd0e1ed9ca6fddf1dcc57e149806e5fe67eb223e31340bb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920633, "uuid": "1a717bd5-5478-4562-aee7-5e65fff2e0a1", "comment": "Malware payload (LummaStealer)", "value": "186153ace97f0d80b53b2edc1be8ce595d033f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920633, "uuid": "c8393f81-c1f3-4000-b957-0d90552c4f47", "comment": "Malware payload (LummaStealer)", "value": "2eb64bb5cb306578973215c5c08e93c0580065c4fbe442c048924b06424d276d386cdfc11e77294ba2933761e75bb90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920633, "uuid": "d3fd2730-cc60-46b1-b6bd-5ee9a75ac8ad", "value": "T14C35C014AD7990DAECD740B1776962217433BD378F385AEF00E4C3291956DEE0B3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920633, "uuid": "391fdfdf-c1ba-441c-8365-9903f9172b54", "value": "3a5649d16d788396ce56dd8cdabd426f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920633, "uuid": "6cfba7a7-7290-4346-93f7-712167712acf", "value": "24576:Q4HgiyW6cRe30ZD/K/GCbSTdinsxX0zk/HrNa:QDVUM1uSSTdisxkQHrNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920633, "uuid": "a1abb74d-fb4d-485a-a2f9-2da3899eae81", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920633, "uuid": "d2fea0ca-8cb0-481a-b038-a5d1e19416c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920633, "uuid": "fd982d3f-0fd6-4935-b1e3-6a84dfbe04d6", "value": "SecuriteInfo.com.Win64.CrypterX-gen.17980.3974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a417a229-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918026, "uuid": "b5ee0f5b-4156-4722-9ede-c810303cf9b9", "comment": "Malware payload", "value": "69283a05ebd63f8c97e9fd512287c006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918026, "uuid": "b457fc39-3d0c-4280-bc8e-861f11be77f2", "comment": "Malware payload", "value": "b5627cd6f95640be11e3ca64440c40487784e049c8859bda6188517e36053c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918026, "uuid": "7780bd57-82d4-4f9a-9d53-cc93958246eb", "comment": "Malware payload", "value": "2e88ed60744ccf9106b85c7ddd85bc7c914ce4bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918026, "uuid": "93c695c3-28c2-4cdf-b9d1-a9f92c4075db", "comment": "Malware payload", "value": "80f4a1bf6efbba3e9f334ddae338cd86fc45168633bcaa510d04eaea4caf2f5954b049cd2f19b7d118f9c60d8ddc4e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918026, "uuid": "b534cd49-e7b3-4272-8757-267525613f69", "value": "T17C56D361EADB90F1DD834875805BA33F57342E05873DCB9BEB502E56ED3B6A21C3A109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918026, "uuid": "96f842e6-faff-4b60-9af8-569710f2d09b", "value": "49152:t8w5MCds7ihJxpTqJJlV6FdZxZdVUNEjZ4dJ4XwNfceHs2cuLABaBJBl/VUMQYTV:D5MCdYwJ/6LV6oJBgsJDVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918026, "uuid": "a515bf03-ec02-4476-b565-8b1a32ac9f60", "value": 6292385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918026, "uuid": "d6c3c260-0700-444e-a4b8-174eb2c56491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918026, "uuid": "c1a9d58b-b4f7-4cde-befe-3e4abed5a7b6", "value": "8.11.9-Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a2bec2-12cc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743933143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933143, "uuid": "23413d63-b1f7-465c-966d-2c792315c9bf", "comment": "Malware payload (Prometei)", "value": "57977b4de2dc9a55cc8f902550fe31fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933143, "uuid": "aee4b73b-3371-4822-96f5-d0d1762bc2b9", "comment": "Malware payload (Prometei)", "value": "b59a7c7f0365f8c8dcdcfc765f6270b671e680f3389ff1e67d0cb42057634c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933143, "uuid": "44bfda20-161b-414b-b7f0-5c5b0ddef56d", "comment": "Malware payload (Prometei)", "value": "844eaccadd645d0db6b448a6c9535483dbea483e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933143, "uuid": "46de8b97-7ac3-4742-967e-13cbc2007180", "comment": "Malware payload (Prometei)", "value": "859c2c8d7e5fb8fcf09fe3cadad1e4fe8ad42798b80df9c14c8879638b1755496b22ab1b7b347976f75ac4a6b0c27ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933143, "uuid": "9f84805b-8fd6-45a1-8b66-577adafb216e", "value": "T1C99423F8C83D2E3098169F3CBB5A825CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933143, "uuid": "9f21924a-a644-4971-b157-57ca75a95d95", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743933143, "uuid": "cf9bba6d-7cca-44f3-bf3f-a5c53da6859b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743933143, "uuid": "2678f81b-cfd7-43f9-aba4-665f73d2e311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933143, "uuid": "0515c86b-065f-4cfa-9692-4ebc51d80e3d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51acc688-1296-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743909727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909727, "uuid": "0ed80b46-810d-45ca-ac0a-10a9b7bb2eb5", "comment": "Malware payload (Prometei)", "value": "6c84c7b9137c3225f26b17776a5cec73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909727, "uuid": "2197df88-22d0-4494-9229-08412b9433e6", "comment": "Malware payload (Prometei)", "value": "b65e41d43f98cde9a785a60eefd0465da418bb7731f114215187beed4b6351ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909727, "uuid": "a2c1ec82-653e-470a-9b7d-c734354b77b2", "comment": "Malware payload (Prometei)", "value": "8f658ec198c5ec194eec9f354c1aed677cf2b15d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743909727, "uuid": "f8f66030-3691-4003-9375-55c90c22ed97", "comment": "Malware payload (Prometei)", "value": "a88e93b58741358ceb48c6183606005ec6c80afdcc4fbdf9bb30ade7992b451dc92ec3abe98d0a9f07ca1006406187b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909727, "uuid": "263b5895-54bd-42ef-8e9a-2a701205f3e2", "value": "T161155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909727, "uuid": "7e562de0-a16b-4b10-9245-8931a8ae07fa", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplT:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743909727, "uuid": "151d601d-cec4-4b48-a7eb-91c4e643df6c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743909727, "uuid": "42d6a89a-c2a9-42f1-a984-8d1c121a5d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743909727, "uuid": "3973ebfe-016e-4413-84ed-1be8a2ece2d3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d3633d-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918057, "uuid": "45f5a27f-ceb9-41f2-bfb0-d16579858d3f", "comment": "Malware payload", "value": "9754da031ba9146ad6f5d837f37e5578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918057, "uuid": "4f789e0e-8f13-41e9-9d3d-12b3df314d86", "comment": "Malware payload", "value": "b683656aed69d8ecc184c095e73ff7db23bb741498d399b935567ec2b6f72251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918057, "uuid": "440c13df-c852-40c3-a895-2f1e0e96a6d2", "comment": "Malware payload", "value": "8cdc6c477cac633c676f1a85504dbc8e2c3cdf5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918057, "uuid": "83920f7b-e976-4442-8bb6-4256e91b5feb", "comment": "Malware payload", "value": "c25bde5e827c65d384d45c5523b5d23af5f2eb3c8895f098b38f024961b679ab2a2471ba9a526b82f0cee27b76f953ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918057, "uuid": "cea89e72-9078-4502-9ad9-17c5ae1aa4a7", "value": "T1AE863AABB3E48268C16DC23AC0A78F01E933B1760737C6E7569016699F629D05D3EF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918057, "uuid": "dabb4f29-4182-4b60-96ed-0e654ab8c797", "value": "566b19b5ac294f4a1afe5e76da03206c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918057, "uuid": "63316383-92e7-49c4-8dac-1e64aba00440", "value": "49152:l7n9NV156ZqrZUkyKyiFnfySEGTI5KACIBeb3Pj9oeon9JuOK6VTjZITgQ+6ydf8:ok8Moeo9VZ4odf8aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918057, "uuid": "99fa4cb1-176a-454a-a1ab-3d4dae48b088", "value": 8338674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918057, "uuid": "da0822d1-ed3b-4e41-a12b-305c3190985a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918057, "uuid": "fc5b9fd5-6bcd-4170-9703-4a4559620456", "value": "Indentif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaccdce6-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918144, "uuid": "81eb3bd2-99bb-4892-b1f7-6814d76f5d62", "comment": "Malware payload", "value": "b189a5ed0c7e6685af78afdf596b1d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918144, "uuid": "71f7345e-b69b-43b3-afbc-c906c2b6be1e", "comment": "Malware payload", "value": "b77f800ab2de904ed316c0516dfb8b99b1da2c8db39f21557a199c1917cbbb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918144, "uuid": "8622dc89-a13f-4da6-ae4b-cbe47763d738", "comment": "Malware payload", "value": "145889244ecb1e7f706847bab623f02416716205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918144, "uuid": "4cfeca71-dcee-46f9-b6bc-ca664bfb5502", "comment": "Malware payload", "value": "6d06add49059689d6f232555b0419022ff5849d93296ca011403aa2da47b780d3f1f54933b3598cd9bc1cd65c478bf9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918144, "uuid": "b4d0f8b8-47cf-4ee5-ac0c-bfaca184ec84", "value": "T1B1A6D360EADB90F1DD835875805BA33F57342E05873DCB9BEB502E56ED3B6A21C3A109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918144, "uuid": "c9c7f004-da77-4e79-958f-7a515602e8c7", "value": "49152:t8w5MCds7ihJxpTqJJlV6FdZxZdVUNEjZ4dJ4XwNfceHs2cuLABaBJBl/VUMQYTV:D5MCdYwJ/6LV6oJBgsJDVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918144, "uuid": "0c464c01-5e98-4b7f-9d2a-e7a058c018b5", "value": 9980545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918144, "uuid": "17afeea7-4006-485b-9ab2-894947529303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918144, "uuid": "84123282-8781-4e69-b328-a767cc8d2f71", "value": "8.11.9-Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9c19ac-1286-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743903118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903118, "uuid": "355d3a01-11a9-4fd6-bc33-18cba7254cf2", "comment": "Malware payload (Prometei)", "value": "17455e091eba05a35d4a61a987d45718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903118, "uuid": "28b7113d-de3b-4bba-a0c9-3b08c895689c", "comment": "Malware payload (Prometei)", "value": "b7b119b1b6121cb013c6e8f2979a5c8820c540f5c567f634600f8a5ad40a1a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903118, "uuid": "fb0c8c62-6866-4fb7-a558-9c92d4ff300b", "comment": "Malware payload (Prometei)", "value": "7bd0a010002215911b9e7b9af6bb31f8c0f79eeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903118, "uuid": "7dbc272a-da16-43d3-ad09-64b729070c12", "comment": "Malware payload (Prometei)", "value": "d0675e9d4f888049f574742f13c75318930b8f948425ea36432e71496e00ca2a3e8e39e96825ee8b4abd01fac6dacfab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903118, "uuid": "63fc0973-f23b-4bda-9f26-46aaf1f3e731", "value": "T1FC155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903118, "uuid": "7cb6064b-ba94-42f7-957b-3147457ccb1d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl5:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743903118, "uuid": "bc22ce65-2692-4799-a6c2-e5a40936aab8", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743903118, "uuid": "1ff043e2-4d9e-4095-b56b-41f909560443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903118, "uuid": "1509e8bc-b106-4346-bae6-afc925da93d6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcb6f33-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743917958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917958, "uuid": "458dbed7-94c2-45c8-9b63-74002173a5bc", "comment": "Malware payload (LummaStealer)", "value": "38d82333308ff47f5a0533da24ed0a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917958, "uuid": "2c593462-17cb-40f9-8b4e-387e14e00b39", "comment": "Malware payload (LummaStealer)", "value": "b8b4c82e29d044563f9eff2f0bda6ff302d0f83070e6959c0ec1901707b6d76d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917958, "uuid": "1b8b8116-b3d4-4f99-bd92-59f2964e3833", "comment": "Malware payload (LummaStealer)", "value": "e8f43f283a350627e550fd1bace20aa928b6ee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917958, "uuid": "f0747b21-5b47-4887-8fa6-0cc3d7664988", "comment": "Malware payload (LummaStealer)", "value": "ba973a656c362708aae2696521a96b46c1dcb3d107ba1fc3d43157811c8898b28306ec077ac551b509b6fb09a5c3e5c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917958, "uuid": "14f05820-d646-4831-9dd3-19c3791a703c", "value": "T19E9533875EA0056FC8ABD93504EB01C339A75993C45E4CBE6E13A0CF6B23652E69FCD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917958, "uuid": "6c36e8bb-e560-4c64-8835-79b2b4d1e7e3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917958, "uuid": "32df5cfa-6da5-4001-8d10-911232bea9cf", "value": "49152:ljj66LeEe6VF31pQwVKAscAjNh6I5vHoZP/6MS:ln66LZPVVQIKA6hrvHlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917958, "uuid": "327814ff-6687-43e5-97e9-1d4e6754b9a8", "value": 1924096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917958, "uuid": "64de3a6d-5959-4faa-95b7-20d4903723e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917958, "uuid": "67410515-d984-478b-be94-42dc783d9a9f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc110ec-12c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743927759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927759, "uuid": "c2fe1537-7592-4749-91de-67f8e75fdfb7", "comment": "Malware payload (LummaStealer)", "value": "6067c3dec335a65c86981cec8c9f50c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927759, "uuid": "1cba6300-e42b-4f2c-803d-888b5bc5c1f6", "comment": "Malware payload (LummaStealer)", "value": "b8d31a5a73175ca42357eae22a6be78dc542fae0a17ca5b4757f2ab420ee1435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927759, "uuid": "36f7823d-3a75-4a84-bcf1-b7b69e59dae0", "comment": "Malware payload (LummaStealer)", "value": "135e42bc3fe852fb5cdebb1393faaf8b1d748ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927759, "uuid": "7f45b1e5-6ad0-4295-b1c9-833cf63524f4", "comment": "Malware payload (LummaStealer)", "value": "c6033585ecf83aa12144f17c097299cf757b75d925b4deb5b2e745d46a056e68dba68ce7d6566ac7a53ac59610928c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927759, "uuid": "06bbdd82-26d8-4e0b-9d6a-196001e07d30", "value": "T1E0D40105B27119E9EC73427E8AA19701A5337C278730DEDF02A887625F17ADD5D3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927759, "uuid": "ecb75641-169b-460f-82cf-ccdc3bcc2a5b", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927759, "uuid": "adb0a91d-d0ff-4793-b70b-0afc8b5cae8a", "value": "12288:xAJvsvm4soaUtcLZAZsr8MAOuM0aD9GWT0gqw00/ovlGGRz7hBS9WYIdY:6wUXF900GTwh/otftoqdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927759, "uuid": "7a894963-80ed-4eaf-8c36-cfa7004917e1", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927759, "uuid": "0fbb5ae6-5bb4-45fa-9453-80860c2b0801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927759, "uuid": "c4fa0755-d056-4d2b-9297-aecd64a7b26c", "value": "SecuriteInfo.com.Win64.CrypterX-gen.6514.15039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cce8b56-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1743918255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918255, "uuid": "0b5b02da-9c5e-4a9d-8a32-a5d2025a0224", "comment": "Malware payload (AsyncRAT)", "value": "151aed30e8c7e93ec86cc7c2a934cdb0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918255, "uuid": "62491cab-b2de-49b1-8ebd-456e00543db7", "comment": "Malware payload (AsyncRAT)", "value": "b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918255, "uuid": "7e3d7a03-5be3-4bbc-afbf-54d5358e23e2", "comment": "Malware payload (AsyncRAT)", "value": "21bc86cafe589e6423b9b9ba92ac4ce51e43e705", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918255, "uuid": "1839a8d5-d306-4c59-bb01-8e5ada1b1fa8", "comment": "Malware payload (AsyncRAT)", "value": "93dbbe2dee2bd9bb7a371bf2ac37909f9a486d70c89b2af67be8948d71f5f40b6c868f301273f162f0459466fea87d2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918255, "uuid": "f56a69a6-1077-412c-9895-16aca3784c3a", "value": "T14801D152414EA55046F7AD820CE41872276DC3D20B34E4FD2CC79C48D0BD4EBCF1A418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918255, "uuid": "6cabbbf8-e693-4504-820d-143aa487e47a", "value": "12:wb4u4XYRdgod1FIfYofh/ibfWfmWfEzflbfdfL8fOzffofoZjbfebffzf3f0Cf5p:wKXYaobFIgoob+OWM9bFz8GzXoQZfGbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918255, "uuid": "523dc476-87af-4aef-ae29-7c6cf8adfc15", "value": 718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918255, "uuid": "17ec741f-82df-43f7-b697-d5d241b7f8b7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918255, "uuid": "6413811d-7ba4-4c46-b7d8-167b5a3aad99", "value": "cmd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d0789b-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1743928768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928768, "uuid": "f7728615-831a-40ca-aafd-6b66c8ede351", "comment": "Malware payload (GCleaner)", "value": "e1e2da6b5cd813d7f0ec3f00990ae47f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928768, "uuid": "641c2a5f-5f18-40f1-a575-d661a8e78cd0", "comment": "Malware payload (GCleaner)", "value": "baf5e2a07be7d2663cb6ef113dd31328c69f7307fd189145189f46cc1bcd37df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928768, "uuid": "02b7e730-4c5e-4459-bf40-0e3b630518b4", "comment": "Malware payload (GCleaner)", "value": "a256358da54ef7e8fd065842fa592ee82f2fd3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928768, "uuid": "0a517bc6-3096-4f65-83aa-55b9e3fb3224", "comment": "Malware payload (GCleaner)", "value": "a00c3d318868b0c56f0f9fa292d46ed68c67e745304574abbd8047770b87d9dfc13e00162e3d27a3fb2e6735192196b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928768, "uuid": "c00b2c62-a5af-44fd-8dd8-0b06e5275daa", "value": "T1CD2633E9288C3B22E2845EF3A0D6D52F42341A94BDB5AD61BDC130BF4CDA23165F547E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928768, "uuid": "c3726150-7c9a-4013-8019-592a7006886c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928768, "uuid": "58db16f9-7254-431e-9c53-06797e438abc", "value": "98304:xgmV4etxB476Wx/tpRtNgKGXiXqQNS8x569SFFjajpVsfoCbTUSd:xJVPB47lhtLtNaiXqQNS8n4SLon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928768, "uuid": "2b3caebf-6ad9-49d9-9950-a597e58f6e0c", "value": 4565504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928768, "uuid": "2e3b693c-28f9-465e-87e6-0dfe43710ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928768, "uuid": "3a3e9a9f-7366-414d-9397-e1920a7121a6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bf5fc3-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935284, "uuid": "c792b92c-bef5-4b7c-be81-cdb8b252ae54", "comment": "Malware payload (Mirai)", "value": "d3a95f4de78b6d87f7da3e85a9c29043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935284, "uuid": "b411e13c-9d07-4aba-abf4-62d83ebf179f", "comment": "Malware payload (Mirai)", "value": "bb1170ec8ba008d687f926bf98eefe837318fee44a28cbf65a24ec80beb641f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935284, "uuid": "75aa3152-4f07-404d-a5a2-6d0372b620ba", "comment": "Malware payload (Mirai)", "value": "2b1004caf083e9480690f8ef63398faab8c41283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935284, "uuid": "3a339985-92f3-430f-8fe1-f2cd59152827", "comment": "Malware payload (Mirai)", "value": "1e90a51f6d90ce74ff01d9bdccdf12207de9aa1ddd721793f7ea6e9b89a2671c327f0b8426729d4567f3cd38c1e95b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935284, "uuid": "ab12fa34-22b4-4932-bc48-db335da41ec4", "value": "T1C6A2E000A9E71B57CC00A975999C78E1C3A8D1828B49036BFBA7C69B34731357889BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935284, "uuid": "62ef638f-13b5-44c4-a6bf-983651b2e870", "value": "384:MAFtexzIuBCZ/M1iOZJr9IjTeFMopUWNlXyEEgZyaikSohhTVTj7I7qCvD8SyQ:5AzXCybZDIqFMHW3XSgYRi5lf6qAD4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935284, "uuid": "a2aa54c6-b4db-4ec5-9a84-33ae746fed79", "value": 21888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935284, "uuid": "b4126ba3-6ef5-487d-b3cd-4c11e6e58ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935284, "uuid": "77eb460a-769b-467a-946f-e6e931e92e47", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1c0f3f-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918388, "uuid": "e9de49bf-eb03-41fa-9990-3b7f0a4f9e75", "comment": "Malware payload", "value": "eb27c7b7cb7d287e126fb7e7229ff087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918388, "uuid": "b0da1203-3865-495b-88ad-4226ab254401", "comment": "Malware payload", "value": "bb468c2741a87f136026f4914bd392a1063d7496ad658a731400907679b9d874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918388, "uuid": "d83e989b-fa50-4da2-a616-2309c9220828", "comment": "Malware payload", "value": "90e3e3a8521f2bc0d7b3632769dbfa2c4f8c9c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918388, "uuid": "d4eeefff-0e7e-44ca-b601-8c2971c3f5b0", "comment": "Malware payload", "value": "3a9edbe72fb9fe54b3fb0e5a93aef7bfb87aefc35488acd7301af9d88d31f8844cff983dcd14e7d823b1292f2f47f683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918388, "uuid": "561576e8-54f0-4bec-a133-a028d657e971", "value": "T1BDF5287B72A5927EC15D813FC193CE40D93331BA2B37CAE786E101699B559C46E3FA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918388, "uuid": "c23b6295-6268-4f44-83f9-84c05c10956f", "value": "49152:PExHcWioiCm3XEyP3605RYCXXLwsSXLJK3quO6xg:PNtfmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918388, "uuid": "08b41829-98a8-4cd0-ad59-be6a407fb087", "value": 3468595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918388, "uuid": "b0104ff9-fcc6-4a1a-91e4-c9266122288a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918388, "uuid": "b59d05a3-8310-49f8-9606-0b786dfd1385", "value": "Identification-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1875df75-1299-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743910919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910919, "uuid": "b06b4a6e-757a-4a49-9e1b-3c89e821391e", "comment": "Malware payload (Prometei)", "value": "b65a26c10380f6e541cf272caeae9edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910919, "uuid": "b292e665-eb5c-4e5f-951b-3ea2e0c16869", "comment": "Malware payload (Prometei)", "value": "bb73902b7e902f27a2a48a10fef92044a70257f51f7fe1e6fb945e25b979ae00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910919, "uuid": "c3544ee6-4f01-4f5a-9b9c-ea64511c8997", "comment": "Malware payload (Prometei)", "value": "ce9b1b2e07b938c4432fca988eb2751f218b94d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743910919, "uuid": "7973a243-71c1-48bd-ad38-dea5d9bff977", "comment": "Malware payload (Prometei)", "value": "f9545dae7ad8d5c35595c5cf43c97f4fac44c1dc69c842da0b286335e0f4834fbae9534f3c2b6d422438de3d927c7568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910919, "uuid": "4ef27f9a-64c8-4952-b1c9-520147ce9e0e", "value": "T1369423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910919, "uuid": "4023fe79-d251-46bc-8050-861a6386e775", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg7:25WOSACZSV6eKRH5EPiamb4DsDwwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743910919, "uuid": "b3fd6fa7-9cb9-4538-9159-c5c40299b018", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743910919, "uuid": "fdb778cb-bc2a-4f4a-a3c5-6b0e02571674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743910919, "uuid": "83beb173-63b3-4fdb-910a-65ab72e6fbf7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ad40ec-1313-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743963466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963466, "uuid": "6b82c0e8-54a6-4dca-a613-0090085730b1", "comment": "Malware payload (Prometei)", "value": "a8a14a69599da5d3a13bef1755048254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963466, "uuid": "4d91af06-db92-45b5-8cf2-b914457d7cae", "comment": "Malware payload (Prometei)", "value": "be0876c647d456e6243d53a55370534956dab6e00ba1a5c35e0d25172fe079af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963466, "uuid": "0d752917-f674-4e3c-befe-ed54e49611b9", "comment": "Malware payload (Prometei)", "value": "fcff16fa9567e8bda0ac2c80d92e8dce621f90cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743963466, "uuid": "84bf889a-5a44-4d9c-add6-17979aabd8db", "comment": "Malware payload (Prometei)", "value": "8a22ba2947682c529e5ebf65c145f195589e75fbbcee4c51c048240cc1062fc5d247881e416878b81a5f8a9ba1009f1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963466, "uuid": "6791fb31-20c1-4511-a922-abdcfcd7f043", "value": "T1CD9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963466, "uuid": "b7a5cb3d-ffed-4bc0-abf6-1d1467b75282", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743963466, "uuid": "3947e1c7-87c8-4a2c-a347-5d2760cfe0ba", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743963466, "uuid": "2fe9f5d0-b07c-413d-aaf1-f0aac8285297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743963466, "uuid": "f366be46-fc58-4d0b-b77d-b21425444838", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25d36dd-133e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743982044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982044, "uuid": "dc602168-0ac4-4dbb-a4d6-aa75c45f664c", "comment": "Malware payload (Prometei)", "value": "0e49f0599c706422449ab24eefef996e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982044, "uuid": "80cd2d8e-71e9-4961-8b9f-d3692fa34439", "comment": "Malware payload (Prometei)", "value": "be490c3a32323d41f52bf9829d87078cd7d6023ced8c4d19509b641ff404f9e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982044, "uuid": "d267a396-c7ae-4a3d-9cf8-87dbe605cc41", "comment": "Malware payload (Prometei)", "value": "7d0df036d2f97d1df19437618df58a9d3c73926e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982044, "uuid": "60d37187-96d0-4a91-8126-4b868e5ae041", "comment": "Malware payload (Prometei)", "value": "bc7ae2284b55fd5be876ecba03f8297ea41495f746a5ee54090464855554a8e78f6aa0b2dea7f66a9cd807bede1fcb3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982044, "uuid": "e66a0ade-5df0-45cb-baf6-ece2c6a527f3", "value": "T1329423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982044, "uuid": "7e31f89a-8699-4f08-9699-91691157a44b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgg:25WOSACZSV6eKRH5EPiamb4DsDwwcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743982044, "uuid": "b2311a4c-b65f-4bd2-900e-cee5a401f261", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743982044, "uuid": "e95e794d-0aab-4c9a-a6bc-f396d687cea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982044, "uuid": "93305a21-315f-460f-82a0-dd7e44daf4fa", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e0b724-12f8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743951771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951771, "uuid": "908ff2c1-3b14-4efd-af94-5c3948228300", "comment": "Malware payload (Prometei)", "value": "d064e4448a69e3213194e72bbea0bf90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951771, "uuid": "93441bb6-5cd0-4fa7-8fad-ff46d4864194", "comment": "Malware payload (Prometei)", "value": "bed8cb4291dab39807ce89c8aa3304cf1897f5122d3e150a7b1971201ff07cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951771, "uuid": "2a42252d-35cb-4bf5-805a-3105a355c00e", "comment": "Malware payload (Prometei)", "value": "d732fb52eb74435c26103243b23503d658875fd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951771, "uuid": "1913f98f-630f-4ef1-b4f4-a505d35f4e4d", "comment": "Malware payload (Prometei)", "value": "f53976d157feccc2a7094db66fd577c050349ecec70fc56255fea8d81eed5f34fda7045910a7b4d4a6298caeadbce947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951771, "uuid": "f9b4ca46-1846-44ca-9c16-33f448724e43", "value": "T1D19423F8C83D2E3098169B3CBB1A826CF0A15772D9562B7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951771, "uuid": "6e35d901-c2e2-4a32-919a-72e98fbd61c3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743951771, "uuid": "2b597e2b-1676-49fc-8fff-3c47c504308a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743951771, "uuid": "ef5a74af-2a2b-4f0a-8657-e2b146c50eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951771, "uuid": "dd065f63-7460-4675-9831-ff904f2bcaf0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412656fd-1301-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743955655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955655, "uuid": "bc0f470f-3725-4ef4-b98f-9699e5a34f63", "comment": "Malware payload (Prometei)", "value": "f2ecb418345b84511119196eff3857bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955655, "uuid": "1d7c4b79-0021-4e6c-82a4-25c5216afd67", "comment": "Malware payload (Prometei)", "value": "bf40f429572dbb97bf6ecbef27ee7e0e1b3ff5d43fe43277269abc384e2aa4da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955655, "uuid": "078a75e2-48fc-409a-9468-7724a7492784", "comment": "Malware payload (Prometei)", "value": "a6ad09e5b7280d1b041d26d022b326be256c0033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743955655, "uuid": "80cb5ad6-b15f-4580-a749-62c156e7d77f", "comment": "Malware payload (Prometei)", "value": "81a812e5b86623e596696310d28132bcf0c6538d00e920a8ab60c01af128d8d76e701940847bad57ab639f95811017b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955655, "uuid": "ec3defa7-f2de-48fb-bf4d-49365c81cdcd", "value": "T142155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955655, "uuid": "55952869-4c0e-42cf-84dd-813e38ff6e6d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplD:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743955655, "uuid": "65f2d003-1d68-4740-bc9e-9cbff075ec02", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743955655, "uuid": "6e48b1ab-6e84-495b-86d4-ea347a63cd60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743955655, "uuid": "71814d73-5c95-491d-833e-98b588d65c89", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c874af20-12c1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743928394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928394, "uuid": "2cfb85e4-2945-4c4b-acaa-3ebe02a569c6", "comment": "Malware payload (Mirai)", "value": "4e6d3bbfe3537ec775dfcf5c5de8f07c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928394, "uuid": "b41da3a6-c32a-4aa8-95c5-dec814d802ec", "comment": "Malware payload (Mirai)", "value": "c0ea0e4f3f0e76aebb2cd34f6a768b219a78fcf349b085d988114c4387ef1d02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928394, "uuid": "d7643d0f-383e-43d5-8168-0602ac019be6", "comment": "Malware payload (Mirai)", "value": "8df1a28ded2266ca60c1e8b30901f8b830eb68b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928394, "uuid": "c0309a9b-bfd7-4c0f-bc3e-de6e7a34b6fe", "comment": "Malware payload (Mirai)", "value": "24401fbed41d7e9f4555ce9d559e9db47625f4b2684b3cec8e4bec3cd155a5ce1506aaaa527d4f86bc7a5e8f3ebf8195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928394, "uuid": "23461862-9a2d-459f-9cb4-758a9532050d", "value": "T115432917B54181FCC89BC1744B6BBA7EAD3271FE0268B2AA7BD4EB222C95D311D1DD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928394, "uuid": "1bb87e91-437a-452a-9376-3d9b9d581658", "value": "1536:HUWEXiNNhZ/QrUl3yqjQr1HTdEuGSSPtQFqAqdStttttttttttttttFtlttttttG:pEyNNhZ/8+3njQt/GSSaFqAqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928394, "uuid": "45030ea0-481c-47aa-ab33-167d086ef6bf", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928394, "uuid": "78ff0cca-04dd-4483-96e0-f4f4593a20c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928394, "uuid": "c8b256d4-a8e0-4abb-85b4-fd7fab3f763d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3293020-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1743920655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920655, "uuid": "a02ce460-128e-4a4a-b5b1-8e25d8fa115b", "comment": "Malware payload (AsyncRAT)", "value": "d66272143362242811fc9849c98b47b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920655, "uuid": "69558829-7cb1-4718-95ca-57df75d4d684", "comment": "Malware payload (AsyncRAT)", "value": "c29d978e33e1d80eb188cff6ebebd0a576480871a0c173f8132a7b14383a50a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920655, "uuid": "b7bc659b-7120-4e63-9b83-8ef68646d396", "comment": "Malware payload (AsyncRAT)", "value": "17194970bbfe4ef0402f413fce909c3ae57e5342", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920655, "uuid": "0761ec6b-d34e-43ea-a240-fa3edfbc385f", "comment": "Malware payload (AsyncRAT)", "value": "0bf207342756e43f5e14ba2e57825154e5a6d6b5c5fc97574a27a043e793f229204364ed13b4ea1041000e516a953c04", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920655, "uuid": "e4167f8f-5f90-4a30-bf85-1cd6a2eb9e5c", "value": "T1F5465A02FD9799F6E847263198DB626F233498020B35CBD7E7447A3EEC772C5583A246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920655, "uuid": "fab80d7a-a37e-4ec9-a8c6-f33fcf501e63", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920655, "uuid": "a1273ce8-f53b-48ac-b14b-cfe4d7851611", "value": "98304:BRz6DQoEsUW47FR0mk3V0fCYe4mb5l74eZN:6DQoEsUW4wD3V0aYe/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920655, "uuid": "7190d2a9-22c0-407e-a219-d6c6b7819d54", "value": 5806080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920655, "uuid": "e105aa1a-0d06-4835-bd11-190a4abd2048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920655, "uuid": "0d6c001d-0a02-4278-8401-9baeba042018", "value": "SecuriteInfo.com.InjectorX-gen.27630.11355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7226a905-12e0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743941564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941564, "uuid": "1fe4b6fe-a52d-4d8c-abb3-1796501cc0e7", "comment": "Malware payload", "value": "2d0426e274912de7e2bdad281011ed74", "object_relation": "md5", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941564, "uuid": "127b34f6-c544-4d4d-ac9e-20d0f2d934bb", "comment": "Malware payload", "value": "c323361c072c13a15bacb14ab61d2d4d581bbd5a551421140deab80e88b68cd9", "object_relation": "sha256", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941564, "uuid": "38c79a7e-32d5-4ccf-b60a-8ee52b6421e4", "comment": "Malware payload", "value": "b1bc34ed4433c7ca6baffad2b046395827493fdc", "object_relation": "sha1", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743941564, "uuid": "dfa2df08-b14f-4323-9bfa-b79fab755485", "comment": "Malware payload", "value": "a4046ee2204b030d1c2678580425d1b9f99f7b64097a17c1fa6d6fcf1eb287cdc8ee9e9bc672df07b2dc8b682d4c44c1", "object_relation": "sha3-384", "Tag": [ { "name": "HOMESTEEL", "colour": "#065378", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0218", "colour": "#E3A244", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941564, "uuid": "b821ec7e-273e-4704-9503-149e32fc80fb", "value": "T12117338DF5460CDEEC82C103AF2E7D3B455F2438969E2568747CFA40385ABD8F7588A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941564, "uuid": "07ce9e27-4f84-4b13-a247-dd96e3bb5cc9", "value": "393216:16U4dS1+MCxBY12qOFn/1hz7VwxbsVPPPLOHoAoIgokF93kKCuMX3:16KnCA7OFn/PLHA+L9ZMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743941564, "uuid": "6ad5dd00-80ae-44d2-933d-31e82a2a28cf", "value": 19648935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743941564, "uuid": "7e8cad0c-f3f1-496b-9b35-9c3803de4439", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743941564, "uuid": "09ec83a7-84f2-414b-92bc-4e4194a6a4eb", "value": "\u0434\u043e\u0433\u043e\u0432\u0456\u0440 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u0456\u0432\u043b\u044e \u0434\u0438\u0437\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u043b\u0438\u0432\u0430.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcfec09-1302-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743956264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956264, "uuid": "1dfbe99e-6dee-463e-b6be-be20906e0848", "comment": "Malware payload (Prometei)", "value": "753247f5cb699896eb4e68a0bf162d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956264, "uuid": "14432064-68c6-44c5-ac20-36c146c54759", "comment": "Malware payload (Prometei)", "value": "c43894c427c648637df7c742fa4d48a11748e727108589f03da28de6836e0e27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956264, "uuid": "ee24dff7-0924-4c2e-9bbb-4eb6f800bc56", "comment": "Malware payload (Prometei)", "value": "6e0217044a73611c521a7a43542fc0725212dbc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956264, "uuid": "efdaa3a5-cbe7-4bf6-afe9-3b2e91a68ddd", "comment": "Malware payload (Prometei)", "value": "a7a340bd19fcf86e65e36c698697419b4b30b10a0dbe4d5f6c9afc03befa191574827c8758aa2bce42dbfc6a22073030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956264, "uuid": "a3c237b9-f377-4d7f-94d7-99081f4368c6", "value": "T1019423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956264, "uuid": "f573faef-2934-4e9f-b4c6-1045c30ba103", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743956264, "uuid": "9378b18f-ebb3-4ebb-be12-a996a558674c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743956264, "uuid": "2b9dc269-5c46-4303-b620-9be75a9ddbdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956264, "uuid": "15df1a74-0cdb-444b-84f7-4c5ed8fa191c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a26a7d9-129c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743912425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912425, "uuid": "91e98abd-d7a9-40d4-adde-52bb8a707e6a", "comment": "Malware payload (Mirai)", "value": "357e3188900f42d0c9992eb9992aff38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912425, "uuid": "6d7f3c60-b634-427f-93a1-ef9a7b4b8a0c", "comment": "Malware payload (Mirai)", "value": "c465a58c9c131fa2480182ca4bbd2cbdd1159ea1317f3aa10e47f82ac8692795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912425, "uuid": "4dd7f4ad-94bd-4bdf-ad6b-6dfd03448601", "comment": "Malware payload (Mirai)", "value": "e948e4c241a3402a8d13ffc9737c1a4f7f096623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743912425, "uuid": "d673e04c-6a85-4a88-ab08-972873a22189", "comment": "Malware payload (Mirai)", "value": "ec7597e863c76d4239dfe74d0132054f7b714ce15fa75753214b77c85c430e898851e3434807ca0584f0bedba559e28b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912425, "uuid": "985e9176-24b8-4e84-b70d-9813dc0fbd6a", "value": "T1F723F1EBE279C5B3E02718F214F69E80B671BC04F7821F6E10F636C91C769B80662691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912425, "uuid": "77664f55-5ce5-4228-8114-125b9295562d", "value": "768:BmJlZRDSHnHac17ivzR5Rdiklxe41P1l8WwIOcmnTIbiRAyVB1XJFx05L:IZRDSHnpg+kHe419lLO5TJLBVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743912425, "uuid": "5c909b47-dbe7-4252-a374-6a73bec72c61", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743912425, "uuid": "cef27e96-904e-4b51-ac9a-806c9a486712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743912425, "uuid": "d42f6df0-7a67-497c-b520-2a09d32ba15f", "value": "morte.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0205c998-1337-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743978742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978742, "uuid": "7548775a-91ee-4a3e-b828-ef486e7527bf", "comment": "Malware payload (Mirai)", "value": "cb7557c864da9c59d3b0db42970d95cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978742, "uuid": "3da65730-1e32-4372-92f5-253ce9615a7e", "comment": "Malware payload (Mirai)", "value": "c5875151bbdca52b533058a5607d3f805b022ba836689a9f54e132b2bf048565", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978742, "uuid": "01a7f25c-cde9-4d08-aa1d-8ddb16ee9e90", "comment": "Malware payload (Mirai)", "value": "89038a0826d4433014b51572f6030d07f5493574", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978742, "uuid": "fab3afdd-f0d0-4943-b1ef-6b856aa40f1f", "comment": "Malware payload (Mirai)", "value": "a500ed43e6232e02ec48093819e6d73e52be02e3ac5a3d4848f53c546d6af9481327a0f393be31b2cd3e7321083e6cd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978742, "uuid": "fc243640-b384-4e65-9701-aaee41541db9", "value": "T1A7F2F16ACB08DC79D23088B2DAB7464533A91B3CF99E35952155CF081F5E0E36AF484B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978742, "uuid": "f6781a55-eadd-43d4-9eb8-61d277b8d529", "value": "768:WKiQ47RQPDNHwJNp47/6hYxZKd8wfntiymX22T19q3UEL6O:ox7IDNH+47mYxczft3mG20L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978742, "uuid": "7a52dcbb-5de1-414a-bfd1-c2adbb4df95d", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978742, "uuid": "44962dc9-e1f5-452d-8fec-18b0a811eb0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978742, "uuid": "04b22502-0e21-4601-bd46-7613634cfaeb", "value": "parm6-20250406-2232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c1938b-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934054, "uuid": "5b4bfc32-21a0-412c-a17c-74d1b3fb994f", "comment": "Malware payload", "value": "e65bdf47ca49a20af5094093fb09fb98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934054, "uuid": "80a6ba20-1fb5-419a-8e09-276e830d57e6", "comment": "Malware payload", "value": "c6d02b1c66c414c33c003f4fe5a6b955fe6473b8d573e113e72e6e0fb589295d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934054, "uuid": "1d88ff91-a987-4047-94d5-8b4712259d9a", "comment": "Malware payload", "value": "747d1336e03e6b404763baf8d5ba2ec0442270e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934054, "uuid": "50f8f088-683e-411a-bbf1-7811f4e8a2e7", "comment": "Malware payload", "value": "1d52ff055859986eec4ba4ad9dba6873fd108ed8c958b4ae57581c196c74fc7f38bafac2f3fff8b2fb7836f06bbf0103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934054, "uuid": "0a7c14cd-699d-440c-bfaf-642deb655ee6", "value": "T17D93C51AAB610FFBDC6FCD3705A9070135DC555722A83B3A3974D82CB55B20B1AE3DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934054, "uuid": "e4fcc874-41bf-49ab-98bb-66663fd3a7c1", "value": "1536:VvN2voVlZ7lbx2f6nvL9bFc2Coj1SZliZcE4u6xpmH0Xba:VvN4o7zSoLj1aliCema", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934054, "uuid": "71b00346-87a1-44a5-aaf6-8ffb67d20993", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934054, "uuid": "889ff188-fe42-4f8d-8e01-317096d70e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934054, "uuid": "032b0a90-8760-4ed4-9956-dea966837394", "value": "nshkmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376c2133-12dc-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1743939748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939748, "uuid": "b1b0e86a-40a9-4b13-b1b4-be105a442b04", "comment": "Malware payload (DarkVisionRAT)", "value": "bf6f64455cb1039947a3100e62f96a52", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939748, "uuid": "0f1820a3-e2a6-40b4-a0c9-89107156080b", "comment": "Malware payload (DarkVisionRAT)", "value": "c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939748, "uuid": "11779077-d496-487d-abe2-63dee2fb4894", "comment": "Malware payload (DarkVisionRAT)", "value": "28cdd5c2e82d4ad078420dcbf4b32b928861fcb6", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939748, "uuid": "4d613d06-06d9-4c87-8191-3f555790e72a", "comment": "Malware payload (DarkVisionRAT)", "value": "5507937381b56be083433fc29337f16c29077d87d2937e48af329023db23774fe4f205243d29c675509c22491056794f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939748, "uuid": "92757241-ddb6-400a-bf44-3fce96fefe36", "value": "T18D45338D36C2B6A4FAB99C7DF3C1E2EE323537919C844C11BCCDADA17A3251450B6C89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939748, "uuid": "7f9a7752-3168-4e38-b642-506ae60370b7", "value": "55347c971789434361ebf2c1c21a714b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939748, "uuid": "ac7929a2-e93a-44c1-9d6e-ee064dc5cc32", "value": "24576:dgnEunWewizz3Q/Nngwxx8T2d920PIGkbQjI/zC5rrpoJNlyZ4:+nEunFxz7Q/Nngp47AGkboF0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939748, "uuid": "1245dc35-8868-4f3a-a116-b0f86f9b8e3d", "value": 1274368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939748, "uuid": "7ce26bd8-e94a-433c-9918-a4940af297ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939748, "uuid": "f30f21ca-d204-4d7f-aabe-258ecedf6839", "value": "UZPt0hR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f79f5-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911822, "uuid": "de303a69-95b2-4b93-bf55-24a7fc44c834", "comment": "Malware payload (Mirai)", "value": "5b39f35143feeacfb84f8ab8610e6728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911822, "uuid": "c8a43965-0daf-4a0e-9dad-b212fd7f2bda", "comment": "Malware payload (Mirai)", "value": "c856916aae5e717dd6a959fbde744f035e79326f90ff2477f9b94b80722fac98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911822, "uuid": "a3f770ce-77a9-4f0b-98b4-394a525476d8", "comment": "Malware payload (Mirai)", "value": "7e6ebafe763d292f7105d7fc2f4176110f829d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911822, "uuid": "2e2da245-9dc8-401c-bd9a-ff7011cd5c85", "comment": "Malware payload (Mirai)", "value": "577319efbd5fad8344172534498b3169ad88e873d929c62bb1c3056d0a72be8917b24ae712ac7e64b33497b6e24fe6be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911822, "uuid": "2dfbd518-aae0-43ec-ad1e-198f0dbecbcf", "value": "T17523023D830A0F329EA8AE3ACD1D13E6BB971F7EA2F622F2100B49555309B56E415C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911822, "uuid": "867fd1dc-a43d-4274-85e5-a1b6ae1bff45", "value": "768:W1aXVZXwRUEfHbZ17SMswhtjBxloj+UiPVkLA1h6RNZ5pdQt3qCzwFXY4nSq5QWK:W1aFZgRJyMhL1Y63k3ABzwFo4nF5zzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911822, "uuid": "71c57098-b0a0-41f3-bb29-854a416a6b29", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911822, "uuid": "d839f5aa-faec-424e-98b1-dcd25234d05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911822, "uuid": "5ada00e8-864c-4cd5-ac6c-e1c25a45f0bc", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f79cf8-129b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911824, "uuid": "b6b08908-7b53-4074-84bf-2d3edb70a9f8", "comment": "Malware payload (Mirai)", "value": "5d7ea4420c87d3629842b6c0312b1d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911824, "uuid": "98f853dd-80ee-47cc-b748-e69ca80cbeb3", "comment": "Malware payload (Mirai)", "value": "c8af8a1dc90eea369ed508922cb36751c0e8e79eabc4aa85ae9fb47d7572e3d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911824, "uuid": "0baa609d-4819-40e6-96cc-ac2f478a3aa2", "comment": "Malware payload (Mirai)", "value": "12f40e4b3c8d5e9ba4f2c9ab6466d5d5c8a78b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911824, "uuid": "32baf785-fd6b-4460-a80e-e8cc331525ac", "comment": "Malware payload (Mirai)", "value": "2d5c69b133461113ca7f3ba0c58b96dda13adeb706df930fca0bba571add2cfc75111f350e38107c07d16996fb5632bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911824, "uuid": "e8423e56-7014-4a33-8fdf-569c09abaa6b", "value": "T16163024980969466DF301C3BDA6E97EC3B4BA6B873FAB0316054233C74CBBC5155AE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911824, "uuid": "3fe85904-01a7-4eab-8ebb-62a1ee354f7f", "value": "1536:PA3Q9ltF222VTgl6+RKVjLNeMfYby1P9gGa5:PA34tFd26lCVjLNeMfr1185", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911824, "uuid": "c7b69919-e709-47d8-b4ad-f6e541a85079", "value": 67732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911824, "uuid": "88dd97e1-619a-482f-b79c-e63f19c5d3b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911824, "uuid": "a8fdf94d-14f5-4abb-9568-460a06ff4b3b", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3256f08-129e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743913326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913326, "uuid": "7ca92f2e-f424-4bcd-a1a7-980e3a72fdb3", "comment": "Malware payload (Mirai)", "value": "9c5977eb1f65efcdea6903d50f879299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913326, "uuid": "88007ad4-85d9-485d-89e0-f3f065867794", "comment": "Malware payload (Mirai)", "value": "ca01c4417711523d9b2cea4b2bbc92ce57c6bada669be6881a9eb42ebb39aae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913326, "uuid": "b49299ae-9296-4832-9883-17b3438507c0", "comment": "Malware payload (Mirai)", "value": "9ba1005cfcb46cad1f1e2752adf9b5da503dbfdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913326, "uuid": "6bc7cf66-1c2b-4b67-ae46-bbd8b21c7912", "comment": "Malware payload (Mirai)", "value": "7f9025ac18edf5e985eed27cd51ed99c639d45bcb2500f2f5084ed2945f3e7f990c924d14b71b09ff0f72ac79ab7dbbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913326, "uuid": "d6326d60-9455-4021-8e8c-fe0ce6716bd7", "value": "T12B62C09DA9230639EB19D4B3488CCD455B4F1A75500BE2776D606FAF523E0CA398E4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913326, "uuid": "a9e1a3ce-73a2-4857-a8fb-2061822a54a4", "value": "384:q65UzBwDcRkIBaFk/8IN/7DqM/RANlN+yAJBUtYH1qhTp/ftBKN:H5UKDcRfBykB/7eMiNGXBU9dRKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743913326, "uuid": "7bc606ba-d61a-45a0-8d79-7ff2969853d1", "value": 15036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743913326, "uuid": "a7da42ae-f00d-4641-b080-29ac09366001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913326, "uuid": "d0926bf1-c99f-4c08-b03c-eb615f6fdc03", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a356d9-12bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743927452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927452, "uuid": "fdcff310-f996-4120-8651-0b1850d521c6", "comment": "Malware payload (Mirai)", "value": "53e74a033ffb1f18cbdee119345bd5a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927452, "uuid": "f367cdd7-2fef-491d-b679-f255e63812f5", "comment": "Malware payload (Mirai)", "value": "ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927452, "uuid": "5dbfc169-dd20-434a-85e6-1ebaa6d35151", "comment": "Malware payload (Mirai)", "value": "56946b3d862c0cc59263e0e56fd5968e3b9e8ddf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927452, "uuid": "4adc8d0b-9c28-4e71-8a3d-84251b47512a", "comment": "Malware payload (Mirai)", "value": "c7fc7c59d9f220da9320ebe51623310663db3bf88a7e84ec96ec2f8cd7f93bcad2f22ac186b0b46368f7b36d02dce48b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927452, "uuid": "7242c1d5-e0fc-4028-a570-1c2d192d85d2", "value": "T17031558A52A69F346D76EF23746BD5207482A18198D96F42D8DCB6E291DEF10B040B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927452, "uuid": "333e3da1-d0e9-4b7a-8989-8ae4c41e2690", "value": "48:UpD+7t7PpD+XhpD+mk9pD+iEpD+fHJpD+2YpD+/JpD++ApD+RjpD+wapD+7P9pDR:U5+7t7P5+Xh5+mI5+iE5+/J5+2Y5+/Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927452, "uuid": "41f31cd8-ac12-4ac8-b310-061ba06871c5", "value": 1840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927452, "uuid": "a7bdfd22-ee6a-4104-9250-6b6b6bbe34a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927452, "uuid": "902f40d5-27e1-4587-94a7-c40e4096e13e", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42855eb-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935286, "uuid": "f9a2e966-e6a3-494d-93ee-15c7eb04be94", "comment": "Malware payload (Mirai)", "value": "6ed0fb6a209cfef3bb61d1553f00c92e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935286, "uuid": "4c5c77a6-0fb1-4c8c-ba76-26eee8442250", "comment": "Malware payload (Mirai)", "value": "ca193a1eecd4cdd43dda07b513aa5a8729613ebf40d0af123bbd4990c3beb251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935286, "uuid": "23143473-71cb-4882-9206-ff2936edab8f", "comment": "Malware payload (Mirai)", "value": "81ac52a36d47b345f8649723d6eda763e2cc6dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935286, "uuid": "a11a0899-3eb2-410b-8e5a-37613d2f67f5", "comment": "Malware payload (Mirai)", "value": "36810cc0692278f8ce6e12d1b52a0bb5fb42d83ff98de8b0b9dfa0936669859ee78b0cb38f03e54a15ae915e1781d94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935286, "uuid": "deaca4f1-0e88-4bc8-8f37-6a79a90c0496", "value": "T12E82BF54A4195D71E6A1453DF5A6CD8362D33BB8D6BA32B121780428A7D1A0B3EFCAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935286, "uuid": "576d6e4b-9a59-40ed-8f55-4de08df96177", "value": "384:MBKcZF+6b1qU9zVXTGoUkP8OdEoDz5tdtg3r1gFcb4QX8ThymdGUop5ht1:MBKcXbt1yo+6z5ntg5gU4QXgs3UozL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935286, "uuid": "e49e881b-dd69-449d-b7e5-c2d2b4006498", "value": 18724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935286, "uuid": "240494e3-705d-4437-ae29-24a4c582337a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935286, "uuid": "40174b71-235a-4d31-90e3-5af795e56041", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7990b5-128d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743905826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905826, "uuid": "d1232551-bd38-4313-bbbd-8b1337bf0cf7", "comment": "Malware payload (Prometei)", "value": "c38886cc6902b75a10b71da9f85e85a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905826, "uuid": "82f8b0d7-a174-4aae-a7e5-fb158a7cc341", "comment": "Malware payload (Prometei)", "value": "caa71eec45ea00b3fa9b5a4cf37627add37c8a8f383571bb178fcfd0ef7f5797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905826, "uuid": "85488c89-f0a6-4402-8189-fb13a9b85ce3", "comment": "Malware payload (Prometei)", "value": "f4f29a6537e130dcefb0bca84e7937ebfbaa4b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743905826, "uuid": "9e480625-f315-41c6-ad44-2c1f89dd428f", "comment": "Malware payload (Prometei)", "value": "aebe349c8600e14952846675cc11073e965a279941917440ab140bc6ad7ee64fab9931c8413873d561c34ce2e9d6a2a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905826, "uuid": "357544b8-079a-4796-ad7a-8ac878030841", "value": "T1799423F8C87D2E3098169F3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905826, "uuid": "6826e074-1a1c-40d8-b3c1-61fae1852057", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743905826, "uuid": "1bd7bae1-9fa6-47e8-92da-2fe7305a3fed", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743905826, "uuid": "aa3e67c1-0fba-40eb-8d21-399a39abea0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743905826, "uuid": "56ffc1cd-ec98-4cc6-bd10-a5200309eef7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d1ff0f-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743917968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917968, "uuid": "9e5c4bdb-fdd7-4df7-a70e-436ff0ae7ba2", "comment": "Malware payload (Amadey)", "value": "ff5c0c7000d1531338ca1946861dc170", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917968, "uuid": "5492c132-fa72-456d-8b91-1f60b282aaba", "comment": "Malware payload (Amadey)", "value": "cb29d42a11a1e61321f281567a80ef3e8f236658f199645c5c472b377202a666", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917968, "uuid": "553a2fcc-2037-494a-abc6-fc72bf0a76ab", "comment": "Malware payload (Amadey)", "value": "42884093990c2523ae57eb323fe331aa0528c449", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917968, "uuid": "6163d971-cd07-44b4-bfd6-78e26d60d44c", "comment": "Malware payload (Amadey)", "value": "0ba8eda2df3dece358b1fcccc6f61dc5020f35df41a0dc924a3a47fb71ecb987982624789ad4155eb902a7efb552c76e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917968, "uuid": "423a50d6-a9d3-4f8b-9ec3-97b1ca48bcad", "value": "T104953329AD61FC98C4C78234F9530F20AD648B5071D1D6DC6CABA366FAC37C4F2D6628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917968, "uuid": "1b288492-3574-4d49-b622-db949fcd22cc", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917968, "uuid": "4d437e89-a71f-4f6f-85e6-1bcd5e1f9d6f", "value": "49152:LDStBiG7A9z8YWVrvRvRAoGRL72DDN9PD6CAMH:3oBiICzZWlvRop2/N9PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917968, "uuid": "834fe4a4-0a7b-4027-8d33-e02fce1d9126", "value": 1881600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917968, "uuid": "b0352d08-c589-4306-b134-939d2ff5fa3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917968, "uuid": "f85f2d54-29ee-430e-ae5f-e863d6b716f3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca042e-12b7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743924147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924147, "uuid": "d318974f-0ad2-49ca-9e92-ae0ae7ee82b5", "comment": "Malware payload (Prometei)", "value": "db883acebfc1df88f067754896984f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924147, "uuid": "1e86f96c-704e-444a-8f1e-ab0c84b82645", "comment": "Malware payload (Prometei)", "value": "cbcddcb2124aaa9a95fa6f21db1df3e08e4f35017a771bda02504238c7b6f959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924147, "uuid": "63871c58-cb52-4157-bbf1-5494aedb6150", "comment": "Malware payload (Prometei)", "value": "63e3148c5f47c75bc34c00c8e49cbd662b80752e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743924147, "uuid": "f91a1783-0556-4e50-bcd7-d240d6a93b70", "comment": "Malware payload (Prometei)", "value": "a891d9677fda8e28dbd7fcde8d2c0d998050c6871d6b71f62d11db2e4377fac3932cac7113e96a958003141399c0e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924147, "uuid": "049d6b9b-38f4-4a10-b2f2-bf79e45a4a41", "value": "T1149423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F7AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924147, "uuid": "23923cd2-5542-4b9d-a64d-52a83469b667", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitga:25WOSACZSV6eKRH5EPiamb4DsDwwcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743924147, "uuid": "52d54e75-5b08-412f-a3e3-3f9a983a3a44", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743924147, "uuid": "e0d7234d-e897-483c-a7f6-0c1d752e1a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743924147, "uuid": "f93d1556-378b-4b89-bbf9-0210a60b6f4e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf82a8b-12ff-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743954761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954761, "uuid": "4484eeef-af87-4698-828d-1089349bb42e", "comment": "Malware payload (Prometei)", "value": "74aaf228222569f741896210da2d9ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954761, "uuid": "0c15fdeb-4ea6-4660-b177-9764eb037f9c", "comment": "Malware payload (Prometei)", "value": "ccc629e5a3cdc25bdb22f8668915db728a1d8ae7942f120de8132425fdc4c142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954761, "uuid": "c1f3ddce-c65c-4b8d-ad7b-ff445ecc54b5", "comment": "Malware payload (Prometei)", "value": "8626a9d3cc4c7c4a8564b0958da34cfe4a7e5029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743954761, "uuid": "8d928e03-c4a4-43d0-83bc-aafd9a404175", "comment": "Malware payload (Prometei)", "value": "138b1544cb12ccef4dce0c13841b4781d91c34b7444fb6ede7b654905da43f87f6c42d9ab1aae41e04989e012219bc58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954761, "uuid": "f7344df0-ef27-47bf-80ec-0435f97c3b96", "value": "T1569423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954761, "uuid": "34979189-172b-485b-8471-a87597f90ef0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743954761, "uuid": "7fe9c8d6-71c9-40b1-b17c-eac847dca97e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743954761, "uuid": "2e7baf73-f2ea-4568-8bcc-d19b0994641a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743954761, "uuid": "f3b96364-2b1d-4c3a-976e-cfd90e4d041c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c4ddd4-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918156, "uuid": "f09dd79c-df2c-429d-80cb-673abdc9d425", "comment": "Malware payload", "value": "7dacdecd1867456b1f43e8eeeaa7080b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918156, "uuid": "72bdc8f8-3611-4150-a537-33c2d4fa051e", "comment": "Malware payload", "value": "cd34fafdc88d62932c751081249bec53764d48208079933198130d98d2be613f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918156, "uuid": "769574d9-1ffa-48bc-8bdf-2fed68c4f0b4", "comment": "Malware payload", "value": "48640fd662763feb4ec5b07316beb74335a2e109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918156, "uuid": "0f13de0d-60ed-4451-896d-24a708198f81", "comment": "Malware payload", "value": "75967ecd3b0bf9b0763b100e9782b2c57d43979d27f361de234d391bc844b8da17398aef7b43438fbaf61dc821116dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918156, "uuid": "31e019c3-f349-4848-9847-05521ff031ea", "value": "T1CDF5287B32B551BDC15D823FC1838E41D93371BA1B37CAE746E0026A9B56DD12E3EA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918156, "uuid": "9fe009ce-ff6b-48af-b1df-589226be3a6e", "value": "49152:G7n9NV156ZqrZUkyKyiFnfySEGTI5KACIBea:Zk81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918156, "uuid": "c636529e-fe31-47bc-8492-7e60118980ea", "value": 3380306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918156, "uuid": "00fb11a3-bfac-4d8f-98f9-556a77bb356b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918156, "uuid": "da9a4843-1e29-41bb-b4fb-3e7ab87ec6ef", "value": "BitcoinCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e42408-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920653, "uuid": "d1dcedb7-20f4-4e49-8080-434bac10b51e", "comment": "Malware payload (LummaStealer)", "value": "fc4a9f6b93dde65bb496eaf9d2e02a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920653, "uuid": "22c90aa2-f54e-4618-b231-6256910d2c16", "comment": "Malware payload (LummaStealer)", "value": "cde10d67a174c5968e5e7b49e8b3c4e8b50fce4b9d6208a37d53972efbc44d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920653, "uuid": "3114e219-cf68-4a2a-815b-49bf6ba5f61b", "comment": "Malware payload (LummaStealer)", "value": "8fa6509732d2fa860e0096b14f385e942a379a9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920653, "uuid": "8e7a92c3-e050-4a38-81fe-94fcfbfc2be1", "comment": "Malware payload (LummaStealer)", "value": "e9e7153c2bccf75c3bc50313427b49504eb9edd7c71b3ddd83bdfb91c893c0d083539d3e8316398518893851ba76355c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920653, "uuid": "a7467e9e-21cb-43b4-a28a-57aac2d813d0", "value": "T19C5533C3B4AC67B6C16B7F3681BBB9154052723FAB647CA04510A2F3A1063B32857B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920653, "uuid": "b4ab1a7d-8dfa-4f49-93db-2b803ab6bd5f", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920653, "uuid": "4032a981-8abe-45a2-a45a-0b8920aeb5fe", "value": "24576:yFqsSRzNIeCEOx9LooqGfP3pMrZhA88z/X3wNy9N/DBwqWyuBlIbLDKIWbfOmpB7:lsSRzNxOx9kRGfPpCs88z/euN/De1wnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920653, "uuid": "ab613dc0-4bd3-4c47-8822-f8a522db19a1", "value": 1317376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920653, "uuid": "624c9e3f-5a65-4464-815e-71f90da1519d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920653, "uuid": "10fb648f-ae00-45a5-8c04-fc0122ce5fe8", "value": "SecuriteInfo.com.Win32.Evo-gen.6053.31493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aec7300-1302-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743956047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956047, "uuid": "675a4405-b5f5-4a8a-b509-94e491df6eb8", "comment": "Malware payload", "value": "ee3890737d5abe96ee8f0bccbd232e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956047, "uuid": "83bce0c8-ffaf-459f-9fe2-f9301e5e00e4", "comment": "Malware payload", "value": "cde57b85462fa409df1c6a1ad3174d234bb2b2d3215362c3e6a5f47a94db64d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956047, "uuid": "385f99d9-cd75-47d3-9492-c9637f5917d3", "comment": "Malware payload", "value": "f4329f0232c597f14d55af7fd937b5818641c9dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956047, "uuid": "9dfef083-c0c4-40c2-ad08-77d731b08ee9", "comment": "Malware payload", "value": "7737a14ce372b6efbd38185b97d3677c54a0e202ef558175b32d36cea654aa3c0549390cbcde158029e3a23bc1a71c51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956047, "uuid": "c1bc3cc8-320f-4878-a3a3-fd6a727252e2", "value": "T1F417BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956047, "uuid": "c3c095a9-2bdd-4fde-a54e-7eed71af7495", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQg:cqYUQuVDt0TZED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743956047, "uuid": "259da79e-7ccb-4829-a353-44a6c173a4ae", "value": 18874368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743956047, "uuid": "cf680ce1-620f-4f1b-b973-867d39b9d475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956047, "uuid": "a0aab02c-8682-49c3-8f87-27b4d2745d2e", "value": "cde57b85462fa409df1c6a1ad3174d234bb2b2d3215362c3e6a5f47a94db64d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9afa71-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915434, "uuid": "f2dfb907-672b-4bf0-9d4d-06091af57015", "comment": "Malware payload (Mirai)", "value": "e93e7e46c96b81433838ea617bbd4d10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915434, "uuid": "0acaef1e-0a69-45e7-a23f-b0631a9362cf", "comment": "Malware payload (Mirai)", "value": "cde745d7719a2f2e3a9144dedff35372180f717d08dc917fd5242f73db561168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915434, "uuid": "4db8e321-32f8-462f-8281-138649024776", "comment": "Malware payload (Mirai)", "value": "0a464d1445adfb90f3368d22f6b2f8c222348f99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915434, "uuid": "3715840e-7f6f-4877-8abc-4ab83429f083", "comment": "Malware payload (Mirai)", "value": "70269731e3cd3f6135a0b08f57e21a94988ac298a116e891b71db22cfefde80988bfedee2051b94a5696027cd03877ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915434, "uuid": "c881d706-7726-4a56-a3c4-ef76def3fa97", "value": "T110232B25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20E5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915434, "uuid": "ecf46131-c542-4113-b9df-3486f3e27726", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcI7s8+AIQjCO+AW31Wwm:nxEjf3xPjrBy1/JcIA8tIQjgjBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915434, "uuid": "7ce0abb5-1b6f-49e8-94f6-ee57e044d042", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915434, "uuid": "fa9cd99b-669d-46d2-8ba8-0948e07758c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915434, "uuid": "c8e90036-684c-428d-a827-70a93363137f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0cf519-133c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743981150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743981150, "uuid": "103c831f-9616-42f2-9b10-2972c2d2e27c", "comment": "Malware payload (Prometei)", "value": "2d9668e6bd5452aea2f4f76a2f08b353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743981150, "uuid": "faa1b153-9aec-4e12-90da-1c429886935d", "comment": "Malware payload (Prometei)", "value": "ce27f87decb24dd9f37c7d0161ea9efb22eee493917e6265fa5381e46c864ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743981150, "uuid": "282f3fe2-92af-40d0-9532-689852dd421b", "comment": "Malware payload (Prometei)", "value": "575b6222b0c7ad6618b4cacfe0bfa738d944765c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743981150, "uuid": "5b9ab317-f260-466f-afac-9024cb0fbd39", "comment": "Malware payload (Prometei)", "value": "e4c58ffba122a3ce66f0a1328706d530fa3bf6b808ba0ffe0575354ceedd922f7d5979fb10bb2782a2373c49add052be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743981150, "uuid": "0751d8b4-db32-4d62-a5b3-499baec3d468", "value": "T1EC155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743981150, "uuid": "610a5cb2-1ac2-4579-aa0f-3fae6bc53a3f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl5:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743981150, "uuid": "c800935a-d7bb-42b6-ae7c-fdfe2516922c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743981150, "uuid": "1ab590f2-0a37-4c97-a659-4a7e70c764ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743981150, "uuid": "75bba1a0-7ab9-4419-a791-8bd7149d8b91", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b186321d-12fb-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743953267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953267, "uuid": "d8d59231-831c-4232-9c2f-539452434d74", "comment": "Malware payload (Prometei)", "value": "4abeafd15ea3ba3cf693bb04c818c5e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953267, "uuid": "4f45789b-a1da-45aa-ae9e-76cfddd50a55", "comment": "Malware payload (Prometei)", "value": "cf1423ddbf2a53960877cb1d2fd1f258b443cb93cc3e104c0cb1181b72fc5938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953267, "uuid": "53c33921-d240-4162-bfb3-1ff3c34025ed", "comment": "Malware payload (Prometei)", "value": "a028ddb5a0230a35c665d7ed4ed63fa6b941ff01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743953267, "uuid": "e7e642c3-51c5-4d06-9af8-2170be37c05b", "comment": "Malware payload (Prometei)", "value": "9d1089c642d653147b4d70fdae93a4e49d327e29c65d82150219ccbafcc3368e123221b7035a7329300169c13675fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953267, "uuid": "25aeb316-b715-4c10-8c57-1c028536dea1", "value": "T1AE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953267, "uuid": "709a3a37-9c4c-4183-88aa-4917e0126219", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl9:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743953267, "uuid": "1dd13eda-b273-40b2-a839-f80bfc3feb02", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743953267, "uuid": "3ea25bd7-152d-4198-b98c-fad1436859a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743953267, "uuid": "95f43efd-0a5a-4f3b-a21e-d33b833b0490", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8fffaf-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918150, "uuid": "ad6a3e35-e433-4122-aea5-83d3084d715b", "comment": "Malware payload (LummaStealer)", "value": "2e56fa5b962d651c073c02467de8e001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918150, "uuid": "0c08e1c0-ec83-4c71-a9e1-25b2b90ff456", "comment": "Malware payload (LummaStealer)", "value": "cf35a65bf2b0b1aa84c9629e32510475f87502e0c8a2745f4a53d7bdaa5bfd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918150, "uuid": "d8ee5400-c077-4616-b89e-4baa34b8aace", "comment": "Malware payload (LummaStealer)", "value": "9667eed96a021d201ac35061bec780fca44a4207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918150, "uuid": "7ba2b93a-a2cf-461c-85e8-fc736c95d507", "comment": "Malware payload (LummaStealer)", "value": "444c474681132c2800556e01db98ae3417ecda0b11e45dc5b95e9022e0465934bbc038fe25e7fa447aba99b16b3f7b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918150, "uuid": "8405a648-a1bf-4b61-b229-0195e2ba9d97", "value": "T12CD40104B2B508E6ED73427E5B559701B6337C278770DAEF02A486221F17ACD5E3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918150, "uuid": "74ea7202-b554-4605-839d-b5d96baac440", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918150, "uuid": "afdbf0fa-a527-4f65-8890-6fe237b96cab", "value": "12288:1AJvsvm4soaUtcLZAZsr8MAOStuoWhWIdiqMJsxL/z0zkXmYHrVXF4:GwUXFsSTdinsxX0zk/Hrha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918150, "uuid": "48bd1d07-d12d-4c14-925f-63033c2f00e2", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918150, "uuid": "25d83e17-7b05-462b-aeee-2493e3973c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918150, "uuid": "d0eb740f-ebbd-4a4d-8292-be4eed0a38ae", "value": "l9543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33035ac0-12b7-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743923849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923849, "uuid": "be1aff4c-2b8f-411c-9321-197b821e7777", "comment": "Malware payload", "value": "d5b8a84afc7e5bec04b276ed680b8693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923849, "uuid": "0ad45f91-6898-4ea6-ac9f-3b1b3688dcbd", "comment": "Malware payload", "value": "cf41ecffccd976b45d5939432dc07b2e06ca5a65ba834fbea992b53241aae9b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923849, "uuid": "b78de99e-85b9-4d36-a097-cdb3d8f4d1fb", "comment": "Malware payload", "value": "e357806663f123b08a2cc7aec129d1d4a53d8d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923849, "uuid": "0ab0d13f-fd31-473e-ba8a-1e55c7c238a6", "comment": "Malware payload", "value": "c0713c24ae0750d17bfb2f6aa78ff4e49cbc5697ff8741823ab587c545847ce04a310b2a9362a41a6df11f7e33ba2f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923849, "uuid": "3d14049d-c7a6-4d83-a85b-0a12138f0e11", "value": "T1EF838D62B5207D8ACC1A29F5B4B0C639CB0165A180C31DB6DDEDF1748097E99FD4EF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923849, "uuid": "ffb36ad7-8bff-424b-9a16-f07723bba4f4", "value": "1536:vp1302l72CiVoOOWMkg+PcQu6UXRDI1cGHf1PXLedTlnOzr:RN02viVoOOnw4VhUy8F7ed+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743923849, "uuid": "615376ac-ffa9-43f0-b40b-93aaa0fb0177", "value": 86872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743923849, "uuid": "30a89d2e-966e-46da-b948-e84321c5140b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923849, "uuid": "25ec1015-5bcc-47d5-9707-a8c450394de4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11f360e-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (PythonStealer)", "timestamp": 1743920651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920651, "uuid": "1e94fd3e-245a-4fa0-ae51-141c5ebfd113", "comment": "Malware payload (PythonStealer)", "value": "e717d08f2813115fea75f3423b85bbce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920651, "uuid": "fa1fdeea-4858-4367-bb6a-c780cddb883f", "comment": "Malware payload (PythonStealer)", "value": "cf7e773ff75c1b2f3df3a804eef95b68e5f9e5c3954cb60e85916da9512757c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920651, "uuid": "8cb23466-6e37-4166-87b0-317461ff20e6", "comment": "Malware payload (PythonStealer)", "value": "38da94cd4447748b80e919c13108ac61cd67c486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920651, "uuid": "2f6c524b-dbf8-4625-96ee-3b8875d08894", "comment": "Malware payload (PythonStealer)", "value": "763e74de4249af72796e0cb8c3975c36d90cf91d6368b981c2db4cf8e64bd6fa7e2bb9a3dff1f49050adb0ad14b5d3be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920651, "uuid": "0b94b8bb-af03-48f4-b29b-a67c512dc2fa", "value": "T1B4C63362F3B334F8C4C92070185E9B71F191FCAA9944ED9AD365E0A42E13BC85D65BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920651, "uuid": "a673c511-d9b7-4a4b-b3c7-b9726c2c81f0", "value": "0cad4d75817cf5181c89bf958567a0e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920651, "uuid": "9ff9852b-191c-4595-9a8c-fd81897402dd", "value": "196608:zc1De5EpjTTuZdydUFjYi9S+Ct8rOGKxPEYhw2FEfD5J56XvnHyag0S5xsrxMgYA:zGDe5EpjgP6iA+CuOl5EYqjf1J56/nNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920651, "uuid": "1525ef94-fde6-404d-bb2b-219643136e14", "value": 12120064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920651, "uuid": "03438b7a-3f31-416d-bc22-957f348e89d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920651, "uuid": "40b4e9bc-62c6-45ae-80aa-72358b4b515a", "value": "SecuriteInfo.com.Win64.Malware-gen.19428.30705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32057f3-1329-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743973053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973053, "uuid": "b3aa2506-c2ec-4045-8f83-23917560aa2c", "comment": "Malware payload (Prometei)", "value": "1f162430aee74560bae5f202e4b5e882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973053, "uuid": "f9b76a44-b018-40b2-b1eb-298bad3c60f4", "comment": "Malware payload (Prometei)", "value": "d074ea77b9b18538ea0815a6818f892cf89edbf758cd5f028709b6ca8b91bf29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973053, "uuid": "a345dec3-235a-4874-b394-60e996ec7e35", "comment": "Malware payload (Prometei)", "value": "aba7b39b3d1a8c3355a7e1cedca1b0969e29f535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743973053, "uuid": "20b7094e-3235-460b-8f8f-62856f1e9cf1", "comment": "Malware payload (Prometei)", "value": "b544e0e9fbee03621adc548cee887225925fc24e4b8bd4757d75020510cde5526fd687abcdce4cabe8d590b7efa2c73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973053, "uuid": "f5d1fcbb-3a2a-4b34-a71f-5c75d8929060", "value": "T18F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973053, "uuid": "cdc9d520-ca03-4d7b-9c75-a4b1d944287f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplW:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743973053, "uuid": "9c8bea56-1ba4-4584-9b23-532ca3221422", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743973053, "uuid": "e9b23838-d82e-440a-b58f-c3d188db0ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743973053, "uuid": "4afdfe96-d6ee-48d6-9958-8e27e11f01a3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a580823-12d8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743937981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937981, "uuid": "0e2f2a81-b6c6-4e48-b515-ee831f4a9847", "comment": "Malware payload", "value": "88cc7511942abd6982ec0f89e36ab8d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937981, "uuid": "042f6c4c-6049-4dc8-8dee-0948343b075f", "comment": "Malware payload", "value": "d08ed7ff77245765ecac36780b7682612d75992e9be5c600c26fbb3015dfa05a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937981, "uuid": "091a71a5-e949-4583-a009-2cbfa64a4f06", "comment": "Malware payload", "value": "f2cefcf85d6ffb051da9945ca409d31a11812fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743937981, "uuid": "0b369a39-f986-4384-843e-6388e14d28a4", "comment": "Malware payload", "value": "93a9564718eddb7ee05a9b9d1dc962ebb3bcc4ebd1a9fd25b2472cc827ed2a46eae6bd0d93f40d86072412a64bbde908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937981, "uuid": "e3b6ad35-5c5a-4269-8be8-1da762adb2b1", "value": "T1AA831229135414E5D62684F1D3FD1B84AE990F69CEE2EC256811BC8DEE333AD2CD3218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937981, "uuid": "b457dbcb-7333-442b-8ab8-1dbf201f7698", "value": "1536:yYIDyrRqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI+rRqw1qAEv7UIFM8oJorFquyjkRks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743937981, "uuid": "7ffcbc1d-145f-4790-b269-c740b6023733", "value": 85232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743937981, "uuid": "7bdd9a56-32c8-4eb8-ad01-8e6e76e45360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743937981, "uuid": "df7e1db8-018e-453a-bfe5-df7097825dd1", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2d9611-1335-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743978219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978219, "uuid": "e7337e21-69e5-4cba-ab2f-a3458f7c3907", "comment": "Malware payload", "value": "ce7453e6024a8c8bcbab306233d55875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978219, "uuid": "04d7f1a9-5467-46a1-945b-edb4bf1c0cad", "comment": "Malware payload", "value": "d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978219, "uuid": "8b80b54a-d12f-4e6a-96e3-bac1afe41121", "comment": "Malware payload", "value": "dde0963a929927e98dd09f9f2f0aad8f9587809e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978219, "uuid": "8de90366-cc5a-446f-b066-6988988a182c", "comment": "Malware payload", "value": "f79bb5a596d74fc9b6ff03facf2158d1ab99bc843fa49ce5af0a42827a6a90b4e724a3368074d612b59cc4b930e42c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978219, "uuid": "4550fb71-5637-4c41-8781-453ea39bdbfa", "value": "T1E5B53380E3054EA1D04973F551272FDDE77B6B8C713E8BFC1E686685F51AB632A32068", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978219, "uuid": "ea93d8d8-1df4-4a61-a7c2-2c1ad8c56d6b", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978219, "uuid": "6f647ea3-b419-4094-b7f2-a005f2dc0e26", "value": "49152:0VpwLEDy+7wdKTJ8xMSxw3M73nbFFHsO4fhoMbVqQ0J5Hu+W3:0Vpa+3V8xUOXbF6oMYQ85Hu+W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978219, "uuid": "77bb86a4-b87f-42d4-bb1c-807a72ca1ce1", "value": 2311096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978219, "uuid": "5cd3260a-ee65-4024-9d9f-44528d12f12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978219, "uuid": "7b0ffe5a-9604-444d-8679-f0217204dcde", "value": "SecuriteInfo.com.Riskware.2144FlashPlayer.28792.31807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00cb027-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920649, "uuid": "87431e50-0797-459f-b268-eeee3c8f07d0", "comment": "Malware payload (LummaStealer)", "value": "725bc1603fc3cf24ecb697df3c37724c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920649, "uuid": "57d1df51-a327-4807-80ca-2f1c0c285610", "comment": "Malware payload (LummaStealer)", "value": "d1a8cf99f1cb0d90b02af778049eecfcaef52e759b9a1737d8fcf74e441d8f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920649, "uuid": "aec75c28-882d-4ad3-9483-297b88b9fe75", "comment": "Malware payload (LummaStealer)", "value": "43ecbba5488995c1822d9a47773bc0be3f4f2294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920649, "uuid": "9ac80d9f-57d1-4659-b917-83e6972b2540", "comment": "Malware payload (LummaStealer)", "value": "a63d536ad7e4ff5b2b36382be97c19a7e9a7ce61ad59f346cdc4125dd29d554a030ac69376ff0b90dcd9b0554f3c2ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920649, "uuid": "72ac6771-0d7a-43d0-9d27-b6cab7ebc30c", "value": "T13155337188D1464AD094777D2333B83C9604C6E18DBDE432993E1B9DDF86A8E35EB2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920649, "uuid": "73702578-cd01-48ab-aaef-27d432d8327b", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920649, "uuid": "054326dd-6732-4c42-9527-e9e097387c64", "value": "24576:ucs4WKYu9+qvmTVHIEFJXalKcQn16oB+Wlo5UAUS+0VAj1TCYGQh7P8W2a:kftalKcQ1pRlwpUS+0NYDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920649, "uuid": "412fa2cc-563b-4aaf-9e8a-436da17d8cf4", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920649, "uuid": "2bb3386b-8b95-4e24-9ff0-e04afe6d6ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920649, "uuid": "d0cc5003-1d9c-4bd1-87a8-baa8f97b9ff9", "value": "SecuriteInfo.com.Win32.Evo-gen.13983.25607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b2eedd-12e6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743943981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943981, "uuid": "ce92969f-e2f2-4712-842f-238f982c248d", "comment": "Malware payload (Mirai)", "value": "c2530f0ec26e9bb46778d1168d07d33d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943981, "uuid": "7e78e22b-39da-4226-9620-287080baa6fa", "comment": "Malware payload (Mirai)", "value": "d23a91081c9e543d1da39d69c2bb28d80023526fa3da2fa186a7e0e0f945217f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943981, "uuid": "848dd879-4ab8-4670-a1b4-4569bf4ab997", "comment": "Malware payload (Mirai)", "value": "6869e1df74829cff1a04875254564428578c9e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743943981, "uuid": "4b9fda43-2ea1-437f-9789-f62b0a113703", "comment": "Malware payload (Mirai)", "value": "280a7acc42bb2a5f53380f5a87f5de0664f27d0abea2f0ded713857d7538b8d88d7017bb425d59d2a27742eec82fc2d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943981, "uuid": "d8d680f9-0cde-4674-826d-d520d3923535", "value": "T1C0C3135293230C0BC02579FEBE5AE61A19872E7A24CD409C46F5D67A5FB7088EEB1713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943981, "uuid": "45013492-9848-4252-baae-110af6bdde91", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZ51g6DobtaeSGPKNkJt6Z2wFZw4Dx1lxt:biMYFJvw6Yh0b1gKobtCGCmCRlrisfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743943981, "uuid": "19c7faaf-3cbc-4f50-827f-34ce1508015b", "value": 128872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743943981, "uuid": "90ad7152-5ebd-4d3b-aec8-12fbe641cea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743943981, "uuid": "740656ec-7344-4a13-8038-e4695be356ed", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1938b2c-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743928759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928759, "uuid": "2497ba78-355a-46f6-b792-611c987f9e47", "comment": "Malware payload (Amadey)", "value": "0d397828202c894e2ef844b26e254853", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928759, "uuid": "6c647208-aec4-420d-a139-73e33611a472", "comment": "Malware payload (Amadey)", "value": "d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928759, "uuid": "9f940127-582e-4f2f-ae08-7b57916b8e32", "comment": "Malware payload (Amadey)", "value": "643c9fa847acfab19a151de57596d88be6d5fd11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928759, "uuid": "62937ef0-f721-4b5f-970a-3d016795d3a3", "comment": "Malware payload (Amadey)", "value": "d02ece5a71d5d8a55e843dd4150690d1e5f7e455c0999004a20d88ad8d14510c1531f193837ff11cb6b0768448af3479", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928759, "uuid": "fc6eaf96-960a-4839-bb32-a6299c352e67", "value": "T17D953327906798B2C964CAB7D235989EB5584ACB0313094EFF05C7468D2BBDF093F962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928759, "uuid": "e6113006-305f-48b5-b8ea-a2c4b7f3f564", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928759, "uuid": "3f617429-4e12-4dd1-9e21-8d5cfed77f81", "value": "24576:ZP/qjRC55a3RpBf0LNafQTUGhQTSg5723OiTkvMX0NwBmsREOrYAirzWn3vBZ3:lqekR0L3waQu823OiwfNLTXoBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928759, "uuid": "1ec2e39c-ce6f-43bf-be6f-23cd40eae998", "value": 1878016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928759, "uuid": "e3f41f1c-c827-47e4-b111-0dbe3da81f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928759, "uuid": "4397f27c-45ac-4e6e-9095-9d47609c91c8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bf77fe-12dc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743939827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939827, "uuid": "3092e5e8-365c-41f8-b9b0-a3b6aa217420", "comment": "Malware payload", "value": "fb23971f37d5c1d0f4c0ffda90872ac8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939827, "uuid": "d9e5dba1-1485-4f54-916b-e2d3f8cb5822", "comment": "Malware payload", "value": "d31ae5901955aea3935bf94bc82a0ad1241baedcb9e798019906a611e70b0b8c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939827, "uuid": "282b15f2-52c5-4400-82f5-b29693fe6582", "comment": "Malware payload", "value": "43c0fab85f98892c72b5ec9c3ad8938375a8990f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743939827, "uuid": "025e9feb-64da-4aeb-b1d0-7558531b2ac4", "comment": "Malware payload", "value": "363ccaa2778f2b92838af6de456ebd1e12e5f9fac283ab2a32b3f753d2adc66f81ead6efd2a7108811f02e0e80d25cb5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939827, "uuid": "eb4af74d-5acd-4b5d-8463-32a0c0ca05f9", "value": "T14AE51282FBE56D2ECC7785360F9A473922468E16C683DB079898763C6D7B2C44F49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939827, "uuid": "e99e48bb-709e-408b-992b-ccf9a83f4dd0", "value": "98304:hiBcUAdk6lQyb3U5oy3DDUNHYA+kOjY+y/pdJ+wu:FUAiKQ+32xDUNH0DjY+yLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743939827, "uuid": "ec7f4450-828d-4cca-9551-dc6f2fdddb5b", "value": 3238915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743939827, "uuid": "dfc67f99-4c24-46c4-ba92-3efff98fe777", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743939827, "uuid": "c9f3de6d-3c8e-4eb4-86cb-651b0e966ce1", "value": "Cuty.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1282cb42-1302-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743956006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956006, "uuid": "1d314506-cc18-4096-bc32-94a973f2121a", "comment": "Malware payload", "value": "4858c582ded7df29b0bbabf6a8f6ea4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956006, "uuid": "73fdb5cb-34f8-48fc-b4f4-db4617fbada2", "comment": "Malware payload", "value": "d38050203046baa587386d152e158fa6983fbed9ffa69b889251d331221a58ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956006, "uuid": "ce5b18f8-f3f4-44f6-a5a8-4134267c4df0", "comment": "Malware payload", "value": "4571370b9dd4a1ed49612a3829b5fba768958a69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743956006, "uuid": "31789d7e-08ac-4746-bbaf-8c6cda50d52b", "comment": "Malware payload", "value": "6aefd563da0b066e6c0bd118516c4d41660ea3447a628006cfa380fe7ce379d7adec9c13977eeeddbdc248772d8d058a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956006, "uuid": "d0f21dd1-30e3-4d77-9328-d6806604081b", "value": "T1C307AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956006, "uuid": "49b84429-a6f5-4c10-9051-26f8b1d8d67f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743956006, "uuid": "1d980570-a73c-4745-9e85-02239a31a7dd", "value": 17170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743956006, "uuid": "b95c7afb-0555-4a79-9ef4-b3b91cabcc2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743956006, "uuid": "c739db8f-c06d-49c9-bb93-4b330795a818", "value": "d38050203046baa587386d152e158fa6983fbed9ffa69b889251d331221a58ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aecc16-12cc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743933141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933141, "uuid": "a105dcb5-62cb-4f75-8a50-1efb9d03397f", "comment": "Malware payload (Prometei)", "value": "66596130b85fd9b96617e9956ed79ef4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933141, "uuid": "9d91471c-0205-44f8-a726-2fa56bd89677", "comment": "Malware payload (Prometei)", "value": "d456f0ccd7db3e8d18c4ac6d722778f807d29c4669329bde31af01569e4fdc65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933141, "uuid": "dc7d86cf-8615-4cd9-a6a5-cf580950c2a3", "comment": "Malware payload (Prometei)", "value": "b65381351d9a65c1a0a9d7fe372d0c2b8b33baf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743933141, "uuid": "6132c5c1-51aa-4b41-8566-58098f52211d", "comment": "Malware payload (Prometei)", "value": "38b8e500156018afa2766f18700e2a550a06987937f6cb88fbf2e0ad940a2eb4f1cbe483025ea98df267ef5282684c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933141, "uuid": "e6e8a412-8036-4742-b750-3fe4b20cf7fe", "value": "T1CD155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933141, "uuid": "148818dd-8398-43b6-b864-5226a3dfb765", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplB:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743933141, "uuid": "663e2814-7a4a-4126-96d5-61803b1a7eeb", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743933141, "uuid": "34c06c38-415d-4075-b305-634017fa7dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743933141, "uuid": "5b6e64f9-45a2-4fc2-8705-e80e3af5a5d1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bb101a-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743938622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938622, "uuid": "5fe4c6d4-f5f4-490e-8720-15f46e6fd535", "comment": "Malware payload", "value": "6fc79506f7a86ced54c4a47039fab00d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938622, "uuid": "1bce2858-7ad4-45cb-b4fb-d70a8922100b", "comment": "Malware payload", "value": "d5ce142ae68ee5061d4dc260ebddd1b4594c2a28c6eefd51a1220a3c830573f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938622, "uuid": "c33e8cd0-8c77-4ce1-abfc-c55e1868f757", "comment": "Malware payload", "value": "4f29e8cb5309a38c08d3d265f1fe2224cdc15241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938622, "uuid": "927ba99d-1bec-4794-9d2f-ec4b942ab124", "comment": "Malware payload", "value": "f629a4867a0d865a3a747ed4973dfceebe95d38dcf3c700fda45ae1f52c6a8bfd0526512ed579b9971c1ac4989161c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938622, "uuid": "8a5f7e0d-ed8d-477e-b6c1-67f62d6ec863", "value": "T13ED42395125A128CE0F25B34527EEDA64CB178B33509B7ED4E51C74CAEBBAD2F648303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938622, "uuid": "ebb18052-19f2-48f6-bc85-7b1cf21696e3", "value": "26354c94437921100ddaecaefb3c280e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938622, "uuid": "663c61c7-1af5-4df9-b162-6c3dc2d7623e", "value": "12288:1ZG+IHHDd120GEoWp1A8ZJpxY27NHans/jCzCVMUt/RS0CZ/IT+:T6jL20GQpzpxY27kAQCVMUt/804/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938622, "uuid": "16ec7542-2421-4d5f-bc2f-a0e59e3906c6", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938622, "uuid": "1a376247-1e6e-41be-9afb-e05ec8d61c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938622, "uuid": "c38240fa-b930-4b1d-b453-56aa43ef3f77", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20939bf-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935282, "uuid": "a69e2116-9319-4dc6-882b-822f9afb2b9e", "comment": "Malware payload (Mirai)", "value": "ea77711fdccc7674d1d58819335fa682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935282, "uuid": "30cd7a2d-16c3-485e-832c-0849de2dd9d7", "comment": "Malware payload (Mirai)", "value": "d729b53e34a87563308806c45d99d786b5f0ef7f619ec7c4b3dc4b880a377ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935282, "uuid": "99f106fe-2056-41be-b106-0dd7a95d541d", "comment": "Malware payload (Mirai)", "value": "c8a47c7069dc16793453c72cec74cf7be989c8f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935282, "uuid": "8a692b8b-c270-4daa-930f-2f86d742182c", "comment": "Malware payload (Mirai)", "value": "d685e63c1cdb1b13bbc44fda9417969303387f6104bb506f1be1008a9392d2ed47564eaea2356d2586b3ca69c845b979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935282, "uuid": "391673d3-47f9-41f6-b70b-8d907c11697f", "value": "T183A2C031B9A6ED60CB600672FE0DC5CB7762C3B9D4FA3252A240156997E110B3FBD58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935282, "uuid": "f1259a9f-47a3-4e92-bbcc-6b0d670b0043", "value": "384:Yk46tj4y5++xQTuMg8ro9gFIxj5dPj2GrvKAZ66QtehymdGUop5h6:L4AT5+GQpro9uIXd2GrLk6Q8s3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935282, "uuid": "b091f91e-acbe-426b-99f4-8450a01464d5", "value": 22456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935282, "uuid": "e10bb333-3a4a-4cf5-87e9-beffa2bcef28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935282, "uuid": "db61bec9-551a-47fb-91d5-413e3052ac64", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd0edce-1336-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743978732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978732, "uuid": "715377e4-72ce-492e-98f8-a8297eacd663", "comment": "Malware payload (Mirai)", "value": "6397667bf2a0c90bd121da025d7465d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978732, "uuid": "fc5945d0-ea4d-45e6-a6ef-22b136f33280", "comment": "Malware payload (Mirai)", "value": "d748f606bed9bdc21a72a9ab0db74a74dd9484736bad3b722216107d6d4f8991", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978732, "uuid": "64959948-cfce-4a18-a513-3935222f95bc", "comment": "Malware payload (Mirai)", "value": "877752296935ed40fa6186b55688edded84dd4c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978732, "uuid": "0c234bb6-467a-4f05-b7c1-4537e9798198", "comment": "Malware payload (Mirai)", "value": "931cc9666bbaa743f5820c5130075411b5e65b26fd0f1abd96d3673d249a609053abeccf5455365ac576855816c0462e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978732, "uuid": "c8f5fdc5-aff6-466a-b78e-74ab72b2b61a", "value": "T117F2E1FDAB66BC03CDED0AB7466F43A549E4F2F0714E0BD6035719C5B930A49A84A8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978732, "uuid": "c149f682-34ff-4831-8fb9-826d1f063892", "value": "768:Ycic7wjLhzW4mLNcsWHkf5QXdn6cbKegkf+2aFKt3gPrWN:rqtmJcxWQt6cbKeqFEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978732, "uuid": "bf535a62-9890-40cf-bedc-bd7db235c128", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978732, "uuid": "9d470d0c-f871-4ccc-9977-94637c682255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978732, "uuid": "b310dbe2-6218-4c90-8a43-74eb94b0882e", "value": "pmpsl-20250406-2232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f667bd0d-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934055, "uuid": "5f9f3d14-184c-4805-a0c3-625b38ff1e1b", "comment": "Malware payload", "value": "b914262f0c6f1ce5ebe075ad1707a250", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934055, "uuid": "d119eca9-1dca-448b-a0d1-7b6157b366d6", "comment": "Malware payload", "value": "d758c042435ba79fb21907859394a2cb024cda5a43933d35cab88a21cff90dd3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934055, "uuid": "9b11fcdd-f51f-4758-90ed-596408aa50fe", "comment": "Malware payload", "value": "a60627e2de2862b36b79c80163bb7680b4a13cc1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934055, "uuid": "665cba79-e352-421c-aa66-9774102792b4", "comment": "Malware payload", "value": "029596b069747b8eef0f26fa7e3f4b154bba9940a1d285e3906bbd4f3d1e20e24ac07f6b046487aed6989f7fab468122", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934055, "uuid": "24be13e9-e87c-46fe-829f-81722a6ef11e", "value": "T10111D5E7E5B10B86454E9E2FBA20C52E5084C7DBE26B47D8FC9C283E0A95858F104E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934055, "uuid": "0cef9aba-233a-4cee-b96a-6573ea0c835b", "value": "12:Z8KShGjsKLKuXnNIh5PpzhPHoAj3/3XJT4Z7Xlp7wdt5jXa/ai0Fz:KK3nKmnNIfP9hP9j3/HJT4Z7X7GJkB8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934055, "uuid": "5723276a-f93b-46cb-8d40-1b0b22d5493c", "value": 1052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934055, "uuid": "c6359280-4cf2-40c3-ad59-79d357d623ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934055, "uuid": "5702f5be-ccbd-4d51-8073-4f465d46ecfb", "value": "sec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7a374b-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934065, "uuid": "6079a970-751c-48c3-99c8-ebb85caf1cd0", "comment": "Malware payload", "value": "ee277ab2b7fc033c644239940857bd65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934065, "uuid": "0b0c4254-0941-4d5c-952e-cc8b6afec45e", "comment": "Malware payload", "value": "d78040062d412038772ad47ed384f621315ffb06523b6e4d294a2ae52d9f6915", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934065, "uuid": "0216189b-6e12-4db7-929f-9ddc28d29ee6", "comment": "Malware payload", "value": "966fc8b796447fccc6257fdc7452af2f68ab204d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934065, "uuid": "4daafd50-7b83-4fe4-a05f-60a704a08aa2", "comment": "Malware payload", "value": "c4f9cba7b12bde221c98b325fa22f6b014b3e4d68a7cfa6e26e8eb560b4b2cd96a25e62fd04e247093051077ed4a3830", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934065, "uuid": "a496ed71-0b91-4283-afb5-b989e79b630f", "value": "T1B5F05EEEE1610B630919CD1EB136C58A6051D18B62278BD4FC9C647C8A78A08B210E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934065, "uuid": "508a7f04-f440-4065-905a-c11284f3addd", "value": "12:mAjrrpLB+9XnNIl59LGjs0LKRSvXa/aKC:3jrrBB+RnNI7kPKekFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934065, "uuid": "749a0e8b-1bd1-4adf-b2f3-2ab677d85c4f", "value": 486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934065, "uuid": "e9fee60c-1aa2-48c5-b9bd-a75e1d47df85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934065, "uuid": "0933a64a-c5f5-42bf-b830-585324e7b5b5", "value": "giga", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f62f456-129a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743911521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911521, "uuid": "d1c7f58a-b0a5-4ad4-bd9a-bf3b6c954256", "comment": "Malware payload (Prometei)", "value": "fd61cda37fe074e72a7ca45edb8a1662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911521, "uuid": "1b9f3bd5-b6c8-44eb-b8d9-ce39bff5e462", "comment": "Malware payload (Prometei)", "value": "d7a46cd056ded8cf47ff79c6c2c2b8d17413f88074105c905226264267f92709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911521, "uuid": "7ec6a282-9d2e-453f-984e-4dc022f9327a", "comment": "Malware payload (Prometei)", "value": "ae4772691f3a1ce1ca63116e846922bb5e5f6a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911521, "uuid": "513d6c2f-b4b5-4806-9da6-cd3f6c2f6e42", "comment": "Malware payload (Prometei)", "value": "f2c28fa9ee5d4e6502b23027676e9ef7f6ffa6690fe01c5b3f03a34eb280059fdf083aa625b0af27eb25e0d50b59e349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911521, "uuid": "1996ddd7-1cb7-40d8-befa-c848e8c05c9d", "value": "T1619423F8C83D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911521, "uuid": "6be92a90-806a-4347-9ca0-a2ede063caf9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgl:25WOSACZSV6eKRH5EPiamb4DsDwwcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911521, "uuid": "898474b8-51c9-4f9c-a9fa-859dc7a03d8a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911521, "uuid": "9ec7ac15-68fa-4fc7-abc8-cd35dd72db34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911521, "uuid": "5dae5f1e-2b97-42ba-a2f0-a322c096c298", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ef031a-12da-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743938915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938915, "uuid": "ad22d228-ad5f-4555-8c0a-5b09281b8098", "comment": "Malware payload (LummaStealer)", "value": "5b51dd2afebc7a9cfe9b6c48db37d538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938915, "uuid": "0d1f1511-9714-4e51-bb6c-b8be793b374f", "comment": "Malware payload (LummaStealer)", "value": "d80a3c4253819907643e1892293112990baf512ecdb9487851a1457928fb6c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938915, "uuid": "cab961a8-d0ec-413d-a3bd-57bd37a5c988", "comment": "Malware payload (LummaStealer)", "value": "3659aaa1ad1ad804dd64d8fedaac64fa3149cb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938915, "uuid": "e3348494-5b1c-467f-a4ef-db8835a977f3", "comment": "Malware payload (LummaStealer)", "value": "716552a7e4b33d90ed9778de39a0a66f6d9ab8c3066deb15aa8309ce0743fcdaf71919573cc94cec914e869e6d35b219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938915, "uuid": "453b8288-dcb8-4ff9-aa7d-09168b926f73", "value": "T1719533A26D533AF8C92DF938A06F6624AEEC6AA0067B1274C5533374BF31F4506F3564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938915, "uuid": "71405dfc-7984-43dc-af94-c2c6e6788058", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938915, "uuid": "75d98fe6-0430-4ebf-9130-888d011950b4", "value": "49152:sreBWYQi3riS87syBQvigRdwExxPdh+WRO6:sreBW2bv8YyBOb7hdhtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938915, "uuid": "67b1b57f-4346-404f-b2c5-377d5fe6b6ac", "value": 1888768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938915, "uuid": "5a923350-3a73-40bf-9d3a-6d88b0546383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938915, "uuid": "3045c66a-ad94-40b4-a115-7b8c1afc05a8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c4dd4b-12b7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743923850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923850, "uuid": "758cc16d-a47e-4e6a-88b5-49192d564b20", "comment": "Malware payload (Mirai)", "value": "5b7127d85a49079a95e9963c3873a227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923850, "uuid": "1e3468e7-5c6a-4fc2-bea9-12f775758fc3", "comment": "Malware payload (Mirai)", "value": "d83c149060c78eb17c3103de69780fb6fe8a8fc1d05a77fa617c75f772ef4ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923850, "uuid": "5b258355-6660-4e78-9e5c-96e2f639ebae", "comment": "Malware payload (Mirai)", "value": "6d65e9ae8b5913b3aabf33eaf5e86dd547c431b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923850, "uuid": "8c728357-1e8f-4522-a20d-1d89ddbbdc0c", "comment": "Malware payload (Mirai)", "value": "8b2660adc9de2b27ccddd51a4e88604006c1f607f2725e1f4d23746bd4687f89829811a8862b67907dfd7b4e35a62015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923850, "uuid": "fd614f9d-2f39-46c6-9802-0f340132fff9", "value": "T128C38DD7B28B7966C42502F60BCB8BDE2A6312128E4FD9D75D1EA53A347C1CB4D0A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923850, "uuid": "a5b6be04-f1ca-4af3-b357-648782f7ce16", "value": "3072:+3vYOTU00LW5k1qQcBlvm/98onq7nJgdd+qJ:yY7a5O0v8qjBqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743923850, "uuid": "716335c7-c01f-4d5c-9353-de3cc017ec90", "value": 124308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743923850, "uuid": "74723653-57fb-450c-ab31-9da00e1840cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923850, "uuid": "dfe8da34-0d6f-40f8-b563-89bea2560ff3", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45434e18-12c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743927745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927745, "uuid": "c1520706-d9d7-4b18-acdf-72e3702cf00c", "comment": "Malware payload (Prometei)", "value": "19aaebbe4e768ed85d5b19619ad1dcfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927745, "uuid": "d689ebbe-6112-428d-9493-3a90543bfb1a", "comment": "Malware payload (Prometei)", "value": "d8ad2186252ec5b709072f096a3fbd25992a6f579f15f0df44f9e6e86c0cde32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927745, "uuid": "fcd22073-2fb4-42d7-a362-afd55a167f04", "comment": "Malware payload (Prometei)", "value": "1ac9fdc797e8415404da9bcd2a24cd8c086238af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743927745, "uuid": "6084804e-06b5-43a4-8365-abb720ece728", "comment": "Malware payload (Prometei)", "value": "22f18762808a0f395101aed3578c3af021bf516c915bd5056297a8a8d9f8fd3845fc2759421d74d0ce300dcb1c816c54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927745, "uuid": "abf4e256-28d7-4299-ae09-ee056cb3b131", "value": "T1819423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927745, "uuid": "aaa27956-53b1-46e4-8880-b1c009b23a58", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743927745, "uuid": "7aa4b419-1a66-434c-971c-d6b99c1e6772", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743927745, "uuid": "de781ce6-15c8-4de7-b71a-ef828c08875e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743927745, "uuid": "f43cd33b-d24b-4aa1-96b0-88bef9e07fb7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c53fcd1-131f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743968559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968559, "uuid": "27e4eae6-6e08-4c78-8916-9df6d89d75c7", "comment": "Malware payload (Mirai)", "value": "f8b2563f1dafa19689b5c28cf702e710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968559, "uuid": "c7909fab-7c2a-4043-8540-b4bc6d8afa47", "comment": "Malware payload (Mirai)", "value": "d9d2fac338ef83dda973589c9c14ef4a731bbddb0f72022b4154f368a03b9255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968559, "uuid": "315504d3-89f7-4ad6-a73c-41183c831efc", "comment": "Malware payload (Mirai)", "value": "b48278fcd319f62a5e2a40542a34ffc95dd70b96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743968559, "uuid": "9fe5273d-0506-49c9-8d62-ab4b9b939eba", "comment": "Malware payload (Mirai)", "value": "c7ca5826c7108a9569d5e49d1842891f41d7bfdc9766f26ac293eed3706cae8d582839401a2bc900c438b3e746447422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968559, "uuid": "11a11b09-41eb-4f39-8733-d9e206f86b8c", "value": "T146831229235514E9D62680F0D7FD1B84AD591F69CEE2EC15BC12BC99EE333AD3CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968559, "uuid": "3819f0a3-beaf-4f27-b7ec-5f8a7582299c", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+u6:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743968559, "uuid": "aa4a2169-acea-4656-8437-7fc28cee47ca", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743968559, "uuid": "1d171dea-d663-41f8-8260-a7697e39ecec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743968559, "uuid": "5a26ca5d-cb50-4c37-9cea-f4b33cc16767", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7b5ff8-128a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743904616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904616, "uuid": "5deb770f-4198-4356-85a8-bbb9844819e1", "comment": "Malware payload (Mirai)", "value": "a1dfa447169cc6df05d143a830218c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904616, "uuid": "9e049570-891f-49e7-92a8-5b313665a1e0", "comment": "Malware payload (Mirai)", "value": "da6b20fc4cc13da83aee629774cf25ba36855744efe668a3e5aae81fbd0913e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904616, "uuid": "f5985191-7ffa-40c8-b074-07920fe7d48b", "comment": "Malware payload (Mirai)", "value": "abcd53159c24da276ccfe39d0874a39c2878ea7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904616, "uuid": "2f4665fe-8a57-4e5f-8c3d-7955de1bdbcf", "comment": "Malware payload (Mirai)", "value": "6cde6051177dae138e9f5ab855ef473ab8c4cab53a8922d22af4285a18019afd15f76d7a45f2c5ad0add8ccaac1e8c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904616, "uuid": "e24df532-7c6d-42da-845f-02b03a752b1e", "value": "T19FA30949FE554B1BC2D233F7FBA903CC37291F98A6DB3211AD35AE6173C5AD02626121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904616, "uuid": "3c11eff8-0ceb-48bf-86c5-4eac1be92764", "value": "1536:6PiKJO46TrguSRVw5Oh78YZ9IgnoHOIs26+ZOkcizItYPsQ7+7gQ+bdHsjqTrx6:fgO463guSRVw5OhgfgnoHOIcv6Gosjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904616, "uuid": "4ce61526-578a-4759-9634-63bf8006363b", "value": 101072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904616, "uuid": "1d565aab-3ec5-4778-bd6c-98a294c75c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904616, "uuid": "dee88405-8392-47db-884c-becf36ab4024", "value": "MCWmH8qLGsVQZzvbYfRMovyxDSv25KlH75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd83ee9-1286-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743903117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903117, "uuid": "0ec5a15e-edbf-4a48-99d1-84397074d259", "comment": "Malware payload (Prometei)", "value": "71cb51b70f3484b4a08c1f052399771b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903117, "uuid": "9e71ec73-f48d-46b2-a36f-ac4aad61758d", "comment": "Malware payload (Prometei)", "value": "da831da242e783aaa617fb8b98db6073985d5628dc14fd7c1031ac11e8973589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903117, "uuid": "c7c80021-4a0e-4208-a935-0f75f9cff16b", "comment": "Malware payload (Prometei)", "value": "5153d08c3615a89a9cfacde74e8c51d010c72231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743903117, "uuid": "332e75e0-612a-4720-886a-9bc3fbf42e54", "comment": "Malware payload (Prometei)", "value": "094ff7055264a8a7938ad44acd46c404d286c6495bed96af98733c97d819ee1aade1212c3d878b381af123f273151a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903117, "uuid": "61089522-56ed-4211-824b-ded00ff86549", "value": "T19A9423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903117, "uuid": "c89c8871-5988-4317-a97d-651c31676580", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgc:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743903117, "uuid": "79b94e50-96b1-4a56-b228-001398e447b6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743903117, "uuid": "8a6293b6-c86e-46ae-af1a-c5dae66c5a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743903117, "uuid": "3c9cbd25-0a96-49a8-a624-fc60a1e43f3a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211ff0f5-1339-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743979653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979653, "uuid": "abb39224-7269-42d8-ad79-93741cc4d2b8", "comment": "Malware payload (SSHdKit)", "value": "74e2dead4d151ca574e8178027cc5d47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979653, "uuid": "fea86bbd-1f18-42b4-bd2b-b4f13d4d8e0e", "comment": "Malware payload (SSHdKit)", "value": "dbaab70f4ca0736b98518f240af8d76b84f274e77eb425e615c5023af7c614b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979653, "uuid": "e90a01a6-b6a8-48c9-ad22-96fdabeeadff", "comment": "Malware payload (SSHdKit)", "value": "d38b6d9f61f12cc4db59e498607aa3d8025637a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979653, "uuid": "1946ec06-076a-4ff7-bd69-4c2519c01903", "comment": "Malware payload (SSHdKit)", "value": "8dcc18fd28aa8f2a9f6b9ab7b3625d5e5f51c70999ec69c77dccb00e6cd689035931ccc459148030d1a1e146aa876446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979653, "uuid": "c72c333f-46ec-48bd-85e2-26e2ca851cf4", "value": "T195356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979653, "uuid": "21cf2f4d-310f-4915-9d0b-9ba4a6d79f66", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVF4Gl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38+T3gRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743979653, "uuid": "eeb7c675-27d7-409a-b032-a39c62e452fd", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743979653, "uuid": "8f654478-33a1-4665-9406-01fce9c9c9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979653, "uuid": "49991911-9287-43db-85ea-e20a4dbb5a96", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6571ac2d-1321-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743969460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743969460, "uuid": "dff11c96-b4a2-4417-96e7-f7d5583cbb22", "comment": "Malware payload (Prometei)", "value": "b4664086a2db1fdd3d0fe6f78b77765e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743969460, "uuid": "8602cb4f-c324-4199-91f5-5f8bcdd05d98", "comment": "Malware payload (Prometei)", "value": "dc6a1408d3954dfcf3fde4be34666ce97ddc6fb70404872d0e1624a8a9e955e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743969460, "uuid": "a0a91d3a-60b6-4e24-bea7-03f2009bb77b", "comment": "Malware payload (Prometei)", "value": "ccb3b0a99028687683891e46a537930f06301a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743969460, "uuid": "67f14b50-5103-4480-a176-d6fa197383de", "comment": "Malware payload (Prometei)", "value": "427fb4c825b3e11cdd4f8afb24422b82fb689048761837052d99e52ffb0e78329151c393c7813915ebafa9b40bc4b587", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743969460, "uuid": "80f360f1-adda-4d4b-ae39-5d7ef652ab4b", "value": "T14F9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743969460, "uuid": "16fadb1f-7854-4235-8b0b-8f8fa326da83", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgL:25WOSACZSV6eKRH5EPiamb4DsDwwc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743969460, "uuid": "27fb103e-69d4-41c7-8b22-e20a5a6dd497", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743969460, "uuid": "abaa94ff-d912-43e3-b501-4b816bef5a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743969460, "uuid": "956f6b4f-8973-4fcb-80db-e9ccca7dff99", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ac4617-12c2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743928737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928737, "uuid": "50928c8d-5cd9-4c0a-9cf6-6664f7f189f1", "comment": "Malware payload", "value": "0e92f3e82c8aaa4877dabbb9dd930327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928737, "uuid": "b614fa8d-dd95-430a-86ad-478f3e0a3120", "comment": "Malware payload", "value": "e098be1ab5555f7ad083d6cdbb88c37bd3f74089f90306e2bce23bcc1905d3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928737, "uuid": "b1945c25-11bd-4577-a75e-aacf3873e22e", "comment": "Malware payload", "value": "afd5dc3634383e1dbaef203436921d5c05410008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743928737, "uuid": "546c18cf-29ff-4271-b8b5-c0e561187e5a", "comment": "Malware payload", "value": "4e4cbb311691fc491e9e713e67de2f2024dfa81f413d195241c46d0ce5f2777773c8cfff6821c7e3393fa2c0cb275674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928737, "uuid": "68270ef5-1d89-4639-95a7-dee3c3d0e1a6", "value": "T156C523502B900CFAFDA3A43D8822911AD6B2B8554BA0D6DF07B057652F277D16E3EF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928737, "uuid": "87dc1f81-9170-46b7-ae47-3f2dfbc5d52f", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928737, "uuid": "a3a5695b-4b1f-4393-b459-09d2959fb4ac", "value": "49152:WwL8sGUeS0u0MQYybcKbBLWIzP5J31S1SnKk8k4dxx0NizYECbKMC2:WMGUVFAYIcGh+1sJ8kj5ECBC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743928737, "uuid": "445082de-a433-45cf-a317-84655e76a0ad", "value": 2571473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743928737, "uuid": "95ff1eac-887b-4f41-bec5-d520af825eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743928737, "uuid": "8746b17f-aeb1-405e-9332-1c2ef3e836de", "value": "worker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae66635-12e7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743944585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743944585, "uuid": "feb42bcb-ccf8-4f90-93a5-03d1d35882dd", "comment": "Malware payload (Prometei)", "value": "90649c009f485234281f9a55cd0526e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743944585, "uuid": "8dd79c4f-24a3-4096-83d7-f2acb50a3744", "comment": "Malware payload (Prometei)", "value": "e1f788ea1fc3de21c03f2e22f7aa317c1b932ae612d142e82b9ae89529cf1d8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743944585, "uuid": "8d63a353-260d-4ead-81bf-bc8148dd7131", "comment": "Malware payload (Prometei)", "value": "4b6d35750fcfd8a2eefc6a9bf76f150d9e23067e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743944585, "uuid": "adafcd5f-6acc-4803-a165-574cba93afb2", "comment": "Malware payload (Prometei)", "value": "4b17b4b32e128e789719a7ead54b31260cf56944ba5f19a4f9baf527cf35b9a72cc7c9603a9b79e1ca3ec06404300852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743944585, "uuid": "e959968e-cefd-44f8-9dcc-e7741cf41994", "value": "T1C5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743944585, "uuid": "ed87c3a9-3607-486e-b261-081a01572fdd", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplk:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743944585, "uuid": "2502640a-3b68-4890-b8a8-5ad6417f2d75", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743944585, "uuid": "085587fc-cbc7-45cb-956e-d5ece9ad22ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743944585, "uuid": "5da448cb-3c59-43ad-b06b-1000dc6559ab", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e042313-12b6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743923545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923545, "uuid": "6ac1f47d-093e-4bd5-830d-8c230f235b8d", "comment": "Malware payload (Prometei)", "value": "ac7685a4589fef67e1646d65ae8a9a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923545, "uuid": "f5511ac8-05ca-4e72-a976-fe188777ce5c", "comment": "Malware payload (Prometei)", "value": "e2fd45eb6f7a8cd64db383c3d665d79de872b7ae29394e961dda1c4d55961eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923545, "uuid": "42a7d77f-a77d-4ee6-8676-556979c2057f", "comment": "Malware payload (Prometei)", "value": "cc9ec89cb9bca085c5b14fed35cf2c72ed19835f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743923545, "uuid": "5473e05b-8eb8-436f-86da-fe0959e5a5d3", "comment": "Malware payload (Prometei)", "value": "25d9776a1c45bc541380d40b1d7138b2b04bd2b4ed0921c5c20319fde01efb823ef28208cab50f22d0942480d1c083f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923545, "uuid": "381f625a-fb7c-495b-855a-665a2dcfdeba", "value": "T1E89423F8C83D2E3198169B3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923545, "uuid": "54bf94be-d2d4-4554-9110-9ca931c81244", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743923545, "uuid": "22ce83f6-1692-4bd5-b5b0-a36e95a35aee", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743923545, "uuid": "fcdeac7c-051c-485a-a33d-581305fcac0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743923545, "uuid": "0a93a577-14e8-40bf-8806-2db02ad477f1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0818fc5-12d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743935280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935280, "uuid": "2789b90e-9aaa-40b5-845e-93f88dddc532", "comment": "Malware payload (Mirai)", "value": "fd600a5701d9141f4f0fa80f33f3521c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935280, "uuid": "50aa8a41-5873-491a-a6db-d9bd168dab1e", "comment": "Malware payload (Mirai)", "value": "e3795dc348feb46e6f2f5943ecfd0865614fc52905fe700a09ef75ca22a91f86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935280, "uuid": "ca8a08d4-bbb2-48b1-83c0-047bf1c812d0", "comment": "Malware payload (Mirai)", "value": "8a954dc34a66738428c55c954ffd095c7ed30c3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743935280, "uuid": "f8036de9-3ef9-4b87-9c48-a446afea39be", "comment": "Malware payload (Mirai)", "value": "aeb818c6d8d63dac88cbb44c23487c86276cb265525df2e24c8ab91b21cdfbfc7f6acefd641709a2405e56b19b498d27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935280, "uuid": "e23ba140-c8b3-45f6-ba73-57fa55777591", "value": "T19DC2E0402732A8E5EE300A7EEA284585A71A5FB4D4ECF01B1129933DDDE6542A9D51E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935280, "uuid": "72e993ed-4bf8-41ab-84c2-df33084cda3a", "value": "768:+H0Gjdpnf+t68JXb7nmrkDm6RH3b4L8VFitx9q3UELs0:WHRpEJ9mw3bC8VAkLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743935280, "uuid": "d6f8af18-15f5-4f0d-9503-e4b01b2a975b", "value": 27700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743935280, "uuid": "a9d543f2-702a-42f2-910a-e2238a737ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743935280, "uuid": "0d4fdcda-67bb-4f9e-8314-c84f03eb4784", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ee59ce-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918190, "uuid": "f4a0395c-6fb3-42b1-b3a1-9bb388a6fda7", "comment": "Malware payload", "value": "609be3bcbf3c0e088efe11ecd7a3e883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918190, "uuid": "ba280ae5-8ecf-4263-9fd6-1f211896e965", "comment": "Malware payload", "value": "e4629912764a2d5d11cf0bb2592dc520fe1a4f14711231affd84382117fd1023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918190, "uuid": "d1c9ebe9-9469-4d5e-9ad3-5c3bc6c1a13e", "comment": "Malware payload", "value": "e1daedf22c8319844841007e8c44c0e78afdb744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918190, "uuid": "bbc87c87-0ac2-40ab-8104-5cf8049342f3", "comment": "Malware payload", "value": "15a06b297983d48633ce237b0fbf16f6b02a07bb3f500bec3bdb62b88c76ddbbb197802a6f1cc2a0383e524eb6f99343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918190, "uuid": "c658351b-2ae5-461d-a47d-890578923d6c", "value": "T175D4D0521C897147E2A3E2F6410B58CB1FF5FE3E891F2938F9C666A144807D43BA157D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918190, "uuid": "e20d7d2a-4147-4f00-a1d1-138f2bdaf7c8", "value": "384:5kw+7ROHAqXM187vLGnFF/tpefNHgYSik9YwnSTnNixfD1Ii+iABc:dqOg1187U/tpeW/ik9YwnonYxDABc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918190, "uuid": "6d03b073-6b33-4988-b6d3-28105f55ed5e", "value": 599616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918190, "uuid": "7f5dae5c-9299-4ba9-87a2-214e8cb07fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918190, "uuid": "ed487b56-016f-4a71-b7e8-cddd069b3d8e", "value": "Photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf82cbe-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915437, "uuid": "c283fed3-046f-4de1-bb87-74c09ceca5a5", "comment": "Malware payload (Mirai)", "value": "748dea2dd8d2157a3ca57c10b4e08ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915437, "uuid": "10d62196-185d-45c2-b2a2-7ba430314e5b", "comment": "Malware payload (Mirai)", "value": "e4a954aad6ec3611d2cf2a2882fbc1c45d3a448e0731a2260f7ffc0f51f2b45c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915437, "uuid": "c466ed66-ecde-4fec-b859-e870bde7266a", "comment": "Malware payload (Mirai)", "value": "0bfac15f01c1fba57b5a9f86b1b54410c006788a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915437, "uuid": "bc58aee4-8b40-4d8e-9d1d-a236af11078d", "comment": "Malware payload (Mirai)", "value": "fd0b0025f30cd9a1e0c4803267973dd85e98b60c6482cdde69b7d61fe713e65f245621590431e33cdc9e6007863cfd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915437, "uuid": "840604c0-6c9a-4a84-b532-e199fe7abd90", "value": "T14503D651F8825A27C2E1127AB6BE4A8E372073E9C2CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915437, "uuid": "1200b626-c4bb-481e-9658-2bdd934b0357", "value": "768:RqILBdhxPh9NeftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMyfE1JomcI2/NkwVkE:k0z+f2G5dmSBWjV8kZbJqK1x2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915437, "uuid": "4ee56c54-2b94-46ed-922b-f49831256cdc", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915437, "uuid": "0c0cc9e3-f2a2-4370-8b14-52f3bca4814c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915437, "uuid": "64368634-9bd4-41a8-a323-bc94d95c12c2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0086bc1e-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1743917322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917322, "uuid": "703628bb-ccaa-486d-ac12-e2c16de8eb58", "comment": "Malware payload (AgentTesla)", "value": "c53dfdf622c154dde72cf23cdded0121", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917322, "uuid": "807712c7-e0c8-495f-8ac1-898011e7d432", "comment": "Malware payload (AgentTesla)", "value": "e5310406101d86da7d0985ebc902849f4ec65928316f86db435614a48599fc82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917322, "uuid": "aace955f-af0f-4922-b0d9-73a1985800fb", "comment": "Malware payload (AgentTesla)", "value": "e907cafcb68a4bb80f4f5b0fa54398a54cb31b1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917322, "uuid": "f9978ddc-64d4-4727-8a07-21f93e5e66b4", "comment": "Malware payload (AgentTesla)", "value": "8bebf986a787c9f77e6a98821d36c38512193b2813162fe06b59d83d590715acb39afc24549ddc2969e24dea82087f75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917322, "uuid": "bddc5e89-46a9-44f6-9fe8-4bc631ef8d98", "value": "T12925AE2273DDC360CB669173BF69B7016EBF7C614630B85B2F880D7DA960162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917322, "uuid": "351df43c-dddb-45e1-861d-7434a50790fd", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917322, "uuid": "02fdfb6f-cce6-480b-b2fd-4669a26f2e9b", "value": "24576:vu6J33O0c+JY5UZ+XC0kGso6FaNQfVjaefa11sWY:Zu0c++OCvkGs9FaNQfAeCPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917322, "uuid": "6efb0249-45e0-4ba6-8033-26353bdea8d8", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917322, "uuid": "a54857dc-7b7b-404e-9d83-c001030fa046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917322, "uuid": "de504640-0e64-48b9-8036-d628a3027358", "value": "Quotation No. 60206308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0a423d-12aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918359, "uuid": "a14ad9f7-c913-4025-8d57-a78e2d641a54", "comment": "Malware payload (LummaStealer)", "value": "a3f2c85f4eca928b98be321c72491bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918359, "uuid": "61114557-46ad-4075-9337-cb61e96fe854", "comment": "Malware payload (LummaStealer)", "value": "e55689b9e3db0fd8a31c3d87ee5580c607370b40e2f97a3a0cdaa61d76cbaee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918359, "uuid": "75990c29-0227-41f0-9213-83e141dbeed5", "comment": "Malware payload (LummaStealer)", "value": "f4766439de97eaf6ac184d3afaed901741fd0594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918359, "uuid": "096ce9c7-74f9-4493-ba4b-a67619ba5fc9", "comment": "Malware payload (LummaStealer)", "value": "b006e2f034498d531365588376bc931270f085da894ad4e043401b39a502f6ae71b25ad94eeefb8371f40f03b61da8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918359, "uuid": "32db4c77-fc69-4879-8e69-fa8a611a1e9e", "value": "T18395227A4D7D211CF44A9271E561BAA92A70F266B0FECD54DE6010E2044EF8DFB1CAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918359, "uuid": "a23247d2-0df7-44e1-bc0d-b535473cf256", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918359, "uuid": "3f7fd4de-1cbb-487d-845e-4ffd5f345cb2", "value": "49152:by9pv5zEF2RzkP4w9G8V1eie8F36pQcpW1x:byLiFlP4w9NVte89K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918359, "uuid": "d14266f0-4f31-4910-a584-50b0ab2f2bbd", "value": 2053632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918359, "uuid": "a03f2216-6dc7-4878-9be4-fe0004082290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918359, "uuid": "f2230742-c19b-49d4-b749-5b8ccb19d348", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6668e0-12ec-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743946687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946687, "uuid": "f9c6dd24-50ad-4a10-94f6-349347ea6465", "comment": "Malware payload (Prometei)", "value": "96a65e337f8dcf9459fc2d80cb59da74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946687, "uuid": "97afe5e9-a422-41c3-aa67-797ae7976714", "comment": "Malware payload (Prometei)", "value": "e6716254e964173aaa8536432fce24cd921e57b0079f9cc21d46539a926f71da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946687, "uuid": "2c7ef24a-b0da-4fdd-8911-1760dcdff7f0", "comment": "Malware payload (Prometei)", "value": "5ce041d5619e680fc9c6cc3c9c5316155d118318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743946687, "uuid": "18520d4e-a341-4102-8ae4-f7bc1c5c5d2f", "comment": "Malware payload (Prometei)", "value": "f4ddd679e98d222f3e482acb979926f7e5aa5fd77c1b3e5f8188cff901bf13c79beaad3ab7e9c27d71c33231a4250e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946687, "uuid": "193d0fc9-29e0-48a4-a811-ab33e7c718cd", "value": "T1BA9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946687, "uuid": "521c282b-cb41-46db-9fe2-c2f7a8437a0b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgbp:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743946687, "uuid": "3338c874-ecd0-4cdb-b0da-990d09758fb8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743946687, "uuid": "aac834be-0961-4761-8e6d-1b3c588059cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743946687, "uuid": "1c9da127-98e9-496d-a6fa-1d256126d774", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f820a435-12ab-11f0-ad17-42010a9c0004", "comment": "Malware payload (BlackShades)", "timestamp": 1743919026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919026, "uuid": "66fa45ac-b5af-4261-ab6e-ac18d8747b96", "comment": "Malware payload (BlackShades)", "value": "36b4b501420aed9f6c11601a3a260817", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919026, "uuid": "3bae4130-c4f0-4e63-a03d-f054951156d5", "comment": "Malware payload (BlackShades)", "value": "e723709ebd1439aa76c850f99d7843b0125f5c8456a53ade128da884e650382e", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919026, "uuid": "84d1105d-1fd4-4948-acde-b1d30145ff41", "comment": "Malware payload (BlackShades)", "value": "e5b0a6e61d9d218e525d28fb1df074b580bf0da5", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919026, "uuid": "430542bf-3334-448f-a84f-24abf07e8672", "comment": "Malware payload (BlackShades)", "value": "e195384207bf9d17e9302e57c095729e340a3200fa6505f944b2f88986b25cdbc5e945120d3f658bbfad964fa44cc896", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919026, "uuid": "798c59bb-5d95-4bf3-8f40-b0c6de7324af", "value": "T15B143949B3B85A49C17D8F7441A603290B34ED47DA2AA65D09C5F8EBAFB63D1CC016E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919026, "uuid": "4b342416-df93-4239-bbf1-30c4d9622cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919026, "uuid": "d539c9eb-abbc-48eb-a013-a17a91e5af23", "value": "3072:9/ixLxWkDDtNZxLaj7wztJoWbUH2wpCr0q0dJ06p2GArI3AivdfZfB1dZaioWEZJ:WxWTC458MzLDaiLyHSj/pobks4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743919026, "uuid": "c035564a-8553-4fde-b1b8-d4543ff68b86", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743919026, "uuid": "33d5645e-c7ab-43bc-8f42-9f1015aa90c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919026, "uuid": "99cc7c78-f0ba-495a-890c-82b071ead851", "value": "17439190246942cf875fb325dff3bb242dff7298c79e86180261b74e506db170a1e185ec38835.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a75c1-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918119, "uuid": "19b6099e-ec33-4e5d-9fce-10f2fef5f1ae", "comment": "Malware payload", "value": "1c129402db9ebba617d2ee15511169f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918119, "uuid": "44b85e43-9f7b-403a-9f94-d1c38b6e1348", "comment": "Malware payload", "value": "e8f7cf641cce592dcd0b01b680922dc4ce7d08298106abb803270a4cf13b6333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918119, "uuid": "6b17843e-2c16-4e45-a2cb-8682cdf30a19", "comment": "Malware payload", "value": "14f651ae789ee6fba12999ec518b5ad8061024e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918119, "uuid": "43589c2e-ccbb-473c-95f2-611df8d35b79", "comment": "Malware payload", "value": "b5e5434b68094ae120fe5eab77ab9c5583104ed43901da674257f34c4b008906a7e24cbef72eb6036eb7d0d9cbd8eca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918119, "uuid": "3615ae68-4b79-4fa7-85fb-d2b960436205", "value": "T162164A17ADA540E4C0EDD63486669223BB61BC89473027D72FB0B7742F76BD0AEB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918119, "uuid": "6e7df962-7bbe-4aa7-90e3-be4e0c216a6b", "value": "49152:0GxYkG5bhNgDjTkxPpq89ZyQo+3rk8nT2X0m/EbwNjPXAjb5Et/VMW/TJxFPRcKU:DBGFIDOrzT2ke6EK1GdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918119, "uuid": "0f66e199-7abd-416b-99de-cad5a3bf566e", "value": 4115091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918119, "uuid": "8717e07a-5506-44db-9e9d-9c4cc91da3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918119, "uuid": "d20e0fa7-2424-4d31-bf96-092f6786730b", "value": "mobiletrans.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca38eb97-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (AdesStealer)", "timestamp": 1743917660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917660, "uuid": "d1b196ab-4f3c-45bc-ac6b-c1060e8f6ede", "comment": "Malware payload (AdesStealer)", "value": "56bcb1cffa2362f6b01cda8e73f5f938", "object_relation": "md5", "Tag": [ { "name": "AdesStealer", "colour": "#E0364B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917660, "uuid": "ac2f9896-24b5-46a3-b768-64e403fe13d3", "comment": "Malware payload (AdesStealer)", "value": "e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e", "object_relation": "sha256", "Tag": [ { "name": "AdesStealer", "colour": "#E0364B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917660, "uuid": "670a966a-280f-4ba5-ac81-be19e3f0a7cf", "comment": "Malware payload (AdesStealer)", "value": "246ad4d1563210827d83713618c725b66bfb8798", "object_relation": "sha1", "Tag": [ { "name": "AdesStealer", "colour": "#E0364B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917660, "uuid": "6c592a84-15e4-4605-89f8-9b2f0a34f44b", "comment": "Malware payload (AdesStealer)", "value": "f447ee985c770496b9dd1864ab997f6b8532a736349e413e7aa1fa8fede335d18e4baab7767d3cd03428c49566aa795d", "object_relation": "sha3-384", "Tag": [ { "name": "AdesStealer", "colour": "#E0364B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917660, "uuid": "fc268d65-a497-48ce-be78-8bd85b12f25b", "value": "T164E3294833F80E41FABF9BF898715692C775B50BAA19F74D098894EC09763E18D81F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917660, "uuid": "78d4c73e-18ac-4b63-8185-fa6864f7ca53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917660, "uuid": "a825663a-dec1-4a95-83df-ac7270aa3213", "value": "3072:pSNIhlv49bKhKFbbSTjJ/ZgCo1wyjlWS8dEAEtMTbgfK4BYjbsrt:pxhlv49bLBbSTjJ/ZgWyRWfRFbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917660, "uuid": "f03a6985-ee09-43df-953a-fb417f5e165b", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917660, "uuid": "267061ae-7cf2-4242-8a62-81e89efc7917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917660, "uuid": "de15c9bf-f8d6-429c-a89a-50f19f06a5c3", "value": "CefSharp.BrowsersSubprocess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106e3680-12ae-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743919925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919925, "uuid": "4b042249-f412-4556-a989-59dfb6fad5f2", "comment": "Malware payload (Prometei)", "value": "90a958e3d19654c430cf731aa3a571fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919925, "uuid": "62afc8c8-7251-4f18-8ca3-4232ea59ad44", "comment": "Malware payload (Prometei)", "value": "ea1bd950a4bcb99685a5ae4aa66d860959ac813e467cc4065b9c027f90525178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919925, "uuid": "09fead1d-3ed7-4785-8d2d-37b7b3af632c", "comment": "Malware payload (Prometei)", "value": "dce6e2cc9de74e13110b8c9fe9a9a55c580e400d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919925, "uuid": "8072f6b2-c201-4db2-9c02-af6a72fcacff", "comment": "Malware payload (Prometei)", "value": "b65e227e042ff1e20f494ba47d84eef7da65b9234517fc686b583fe3ea86d31d35ac647a63ddbc779c71dfaa15b2cf1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919925, "uuid": "f4df2424-d7ba-40f3-8dae-ebe6dc0a0cdd", "value": "T16D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919925, "uuid": "7eec096a-d684-464c-b7c7-1d679e1b7c38", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplf:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743919925, "uuid": "f5cf4498-a7bf-46c8-b2a3-250b9573b5a0", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743919925, "uuid": "097b291b-ff00-4763-a271-0b0569733ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919925, "uuid": "31c95286-ad41-400d-aa20-29fd2b7e8cc7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6113ba03-12b4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743922638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922638, "uuid": "2f8ebf7a-094d-47cd-8c0d-2bd99d621c26", "comment": "Malware payload (Mirai)", "value": "0868481f76ab26e40593e80d879eac39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922638, "uuid": "53cc58e7-ed60-49ee-8f68-c718d3cdbbd8", "comment": "Malware payload (Mirai)", "value": "ead4b0a7f11ca64198e6abca23703990bd1faefcc94291a24491c30cdc6060f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922638, "uuid": "6551b7d8-924c-41ca-bfe9-a010a649cf7a", "comment": "Malware payload (Mirai)", "value": "8db531122c93f490af412058c808976b3ec4f378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922638, "uuid": "a991f9da-3f8d-4145-95ca-3ee5d3549f9f", "comment": "Malware payload (Mirai)", "value": "efd5e758ef43dc913fcd7b141d8926e656db676b479443c65647740ce722c69b66ab9b40d85ee6a90e16be6cbfc66973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922638, "uuid": "6ae33d76-e545-444f-85c7-1c77f83eef2b", "value": "T134C3B40E2E358F2DF37DC33697B74A219BA8738526D1D689D26CF9121E2034D640F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922638, "uuid": "53feed52-f507-457e-b6fd-805eb9c07635", "value": "3072:nj4HAUm9Us577OvF2lCSr5g8SzWK9TgxUNdgxgaOGseTLb8jpsGPntz2jj+riDd1:j4HATC677OzPtK6q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922638, "uuid": "48eb5d9c-bfbe-406e-86b0-f178178a6fd0", "value": 126336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922638, "uuid": "6587e38d-c05c-4951-84f9-18c9846bd4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922638, "uuid": "c66e34c8-36cd-4ac5-88b7-963d35f82376", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7fdb06-1299-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743911221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911221, "uuid": "5b7577df-93a1-43df-b99e-32eda5945ab4", "comment": "Malware payload (Mirai)", "value": "b256cfc5587200b045d60077cbdd1dbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911221, "uuid": "16fea793-a81a-40ef-9925-d20f527f0606", "comment": "Malware payload (Mirai)", "value": "eb8c3711242d572d21d97dd3cfd8ac18288fad84a17ccb2b8efeacd09b03058d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911221, "uuid": "e37cc6d6-12fa-483f-9ad6-ae161cfa8b86", "comment": "Malware payload (Mirai)", "value": "4ce9ee0c2565682ceff334ebf8372fb639063fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743911221, "uuid": "bedc364b-f185-4188-bb7b-1f789073b0de", "comment": "Malware payload (Mirai)", "value": "7e187f10d47b8a1556f401d89c08455fbb74f0fe701ae43d7e63222cc1f75f6be3a709396a385cae7e09834c7347a4e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911221, "uuid": "becd7c20-23bb-476c-9c31-59a8922bb8ac", "value": "T18D14423A7E21AB7ED2A841310BFA6F74CF5529D337A19241E27CE6185E7128C0C5EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911221, "uuid": "efe9041a-ab64-4a14-b479-e6c8c019d7ed", "value": "3072:YhwZRg8tuqYWwXxy9rb+33tFetC+4/ROw1JNV8UM6lhcHQGKvqco1yF79RFprT3y:/YphogFDf+7mSnDDTlPWDyaejZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743911221, "uuid": "1f9faa3c-3855-45a3-8f08-c5bcd3f6fb92", "value": 204676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743911221, "uuid": "056924ee-6ce6-40a4-b5d5-fb48336f0491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743911221, "uuid": "4716cfc8-1c2e-4c7e-9fc6-49bb88abe925", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e525f29-12a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743915439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915439, "uuid": "1de89816-d5db-457c-95f2-feea8a04c084", "comment": "Malware payload (Mirai)", "value": "ba27bfcab6961d7eea38ef78424efc8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915439, "uuid": "b2fc4534-f7c6-43d2-98e7-625d54df13f8", "comment": "Malware payload (Mirai)", "value": "ebbc237ccc2f341d0c4566ff0ab42d4219bc0f9aaaeec84070ccb89ef45f8a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915439, "uuid": "690c2a91-78d2-4aab-b822-e7e8a09d2cf6", "comment": "Malware payload (Mirai)", "value": "91a050772f5f0d9ccec000f4d09431905968265e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743915439, "uuid": "b009c711-c484-41d6-b97c-9089c1a60042", "comment": "Malware payload (Mirai)", "value": "0a74917b110f687dd74d0e95f23430d18c888dab85e6c51858399e2d0ebe719cbcd25706e93854aeb6cf2a2f21c6877b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915439, "uuid": "46c43dbb-17fd-4110-9d6f-b6a3c5d8d430", "value": "T1DB137D7BE4AE5E54D0460230B4689E341F13F6C493536EF71EAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915439, "uuid": "d2ec9b2d-c5a7-45cc-921f-adac5c49e470", "value": "768:WaRH4ge4hYyFDinQT3yMILrzCideITC3o9C7N8C/ww:WaRYghh/FmnQyMiqid9Tf9e8C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743915439, "uuid": "4135b210-7db6-4c81-ba70-c439d6892bdc", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743915439, "uuid": "47ec22ab-d97c-4d07-8fd8-f2bae0b8fa5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743915439, "uuid": "419e2d46-9e3a-452f-922b-7a202e5e05ef", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b036a929-12b3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743922341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922341, "uuid": "4345a1aa-c2e5-4c8c-89e5-862559dd4e0b", "comment": "Malware payload (Mirai)", "value": "55739cb785f1de0ac5ffb5523e7fbaf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922341, "uuid": "534c2af7-d4b4-4093-8da5-92a92d4e9ed7", "comment": "Malware payload (Mirai)", "value": "ec09d8b8eeb4e4cb9ca44b5334f27fdbcf0175953f0cc16bff842bdf7469f895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922341, "uuid": "13569599-1de7-4274-a9be-cc86e5e954a4", "comment": "Malware payload (Mirai)", "value": "1adc7ce6048d61351c9a0e74895d9d815248782d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922341, "uuid": "f0412f7c-0d29-4bb1-a7a6-e429873405a9", "comment": "Malware payload (Mirai)", "value": "3d9521c579f6b10f3c0b0a72a78615622cbb9ec7e1e4add68daff051f33cbf9041fffe94f663ea0fe6159cfa76ac2fa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922341, "uuid": "136b9317-e739-46e1-9a11-2cb716969f70", "value": "T1F5B35AA46D4E7DE3C3CBD37E9F088A71711BB174C96152E2BA1193DDC2CE9AB99E0440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922341, "uuid": "43cb13fd-a5e4-4ce6-a4d7-c749e8d83800", "value": "1536:aVoKEDbC1mO4VuvLAgAoEVlPHJ4DdUscEU2aY+dBIIkNE1GtyzHm0:4oKEDYB48AflvJ6dUscEhm4IahtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922341, "uuid": "cbb8b154-09e9-44ea-afc1-23967ef4f90d", "value": 108424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922341, "uuid": "70720805-2eda-41c7-a3a9-3553d48886eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922341, "uuid": "31f33e03-3928-4607-9f28-6b41dafd9977", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9347bbc2-132c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743974261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974261, "uuid": "590854c0-c556-4536-9ad7-9c6707c62f56", "comment": "Malware payload (Prometei)", "value": "e25450ff0defcd6a92ccbd7bdb0a5a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974261, "uuid": "763f7b55-a2b5-4b45-b991-5445db1af324", "comment": "Malware payload (Prometei)", "value": "ec0ad5d7b57c031a0c0b03e0f1e5c5b08a7780bf64cbe94d2df837fdac7fd758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974261, "uuid": "b9627aa1-5f28-4cbc-afce-3d1cf8729163", "comment": "Malware payload (Prometei)", "value": "f67fff3e6702b9d710bb40b0e660819baee8ca60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743974261, "uuid": "13243c12-27f7-45db-bffe-25e0c0aa3f10", "comment": "Malware payload (Prometei)", "value": "08d25a1f741870ccc0436b20e1a9b1c3445137dce48935681ea75797185ef7f7f68d51fd27ff9cd1ec7c67e4f228914e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974261, "uuid": "4def4b22-c92b-48a3-919c-6e4010d8712d", "value": "T1629423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974261, "uuid": "30d84688-5676-4fb5-b6a0-7f8f8cca3438", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743974261, "uuid": "a039e127-0cc6-494b-92d6-445d76c3fb45", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743974261, "uuid": "ee899a68-8db7-4a7c-97b3-487e5a93566a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743974261, "uuid": "590e2edc-e457-41c6-9ada-4498fce8a8b5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdd98cd-1338-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743979356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979356, "uuid": "fbfad66b-5d88-4f08-ae69-cb44cd558700", "comment": "Malware payload (Prometei)", "value": "345f854f809b65629e5d6ef19954112d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979356, "uuid": "c1603bb4-b177-4985-ad22-b0555954fa1d", "comment": "Malware payload (Prometei)", "value": "edac557b9721ed54150ab954920e3bb1d2e478065dff1f211bcf77ab9f17fca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979356, "uuid": "9f1621c0-a1b9-4974-ae96-91a293096416", "comment": "Malware payload (Prometei)", "value": "5448a2113b9ce8f58f6f906b5eb4c128aa2a8231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743979356, "uuid": "5bfd10eb-0990-4bc9-882b-6bab18415526", "comment": "Malware payload (Prometei)", "value": "27aebd081eac59d83cea471a08859d19356799e61f9e4d89d706dbb7855cb6ebc9f4e87e6ff0007ebe6ba942cedc74fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979356, "uuid": "67743feb-b5be-490b-b676-064a28b1f29b", "value": "T1A29423F8C83D2E3098169B3CBB5A8268F0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979356, "uuid": "7f000f72-c31d-459d-af37-d3ce982fcec0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg9:25WOSACZSV6eKRH5EPiamb4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743979356, "uuid": "a328fc9d-f5f0-45eb-972b-b1d9cdd8a239", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743979356, "uuid": "398448d1-dff2-4c77-9c88-90d66a2021e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743979356, "uuid": "1d8fd001-3795-4ca2-926b-6a850a88bf90", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c974203-12ad-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743919624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919624, "uuid": "705d35da-d36e-41f8-90d6-6628bfd396e7", "comment": "Malware payload (Prometei)", "value": "62f670c1d783ba62a8623a04face2686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919624, "uuid": "7a6ff199-993c-48dc-8bc9-7499675b0ecb", "comment": "Malware payload (Prometei)", "value": "eed96bf0d54dd10335ff4a085c051773d51620758a1a6b288a94d4b041b07260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919624, "uuid": "69e0f608-12ad-4d9b-8f1e-3504ee4430bd", "comment": "Malware payload (Prometei)", "value": "a6a5192d3b420ad1b9cfa83a9163a59f532a3a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743919624, "uuid": "871ed285-ef5b-4812-8d8c-46f137f91ab8", "comment": "Malware payload (Prometei)", "value": "152ee9103d641f5989e5717f696d69fdf03657b09a66885c37401ccb13daeb003c526a899585d745b0351ea1e250b549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919624, "uuid": "d2812b21-1583-4e15-a207-9f98750c9d32", "value": "T1999423F8C83D2E3098169B3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919624, "uuid": "19b99b96-81b4-4f6e-aaa4-d40a656bddf5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743919624, "uuid": "59d0d53e-04b5-4b70-97b3-e6492a97249d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743919624, "uuid": "ec0c22f6-2e19-4480-8663-263d39f79ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743919624, "uuid": "6c6805af-ac76-45d9-bd1e-04f0fba4fa0b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60ea2c6-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918136, "uuid": "b86983d9-ff98-4b82-a6d4-5f20f44e7df0", "comment": "Malware payload (LummaStealer)", "value": "1c9383117c2907d890d7b1638fe5c9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918136, "uuid": "fea87e17-79cc-454a-915e-a64859977d3b", "comment": "Malware payload (LummaStealer)", "value": "ef401debd9f556f039784d43ef098b1de91d45367222e99f680ef53a1150bb46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918136, "uuid": "ca608d94-edfe-406c-8d62-56dc6e823d80", "comment": "Malware payload (LummaStealer)", "value": "b90c50c7c85c8765ef3b118882bc9d90f0aeeebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918136, "uuid": "fcccc7ab-30e9-47b4-b167-4938dd253867", "comment": "Malware payload (LummaStealer)", "value": "9b6e9e6b99369bf00cb72e6205ace08f6daea97667573001982efb32a49a665e5d2bbf93e8dcd2133b1a401cc26a98f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918136, "uuid": "18d01e66-ebce-403f-a79f-94b687b15501", "value": "T17B9533019EF444D6F2C8CBB4043BFB52F5E5385576DEE88A530FE65C58E0AA439D24CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918136, "uuid": "cf6995ca-8b98-4935-a317-7d54a39dd14c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918136, "uuid": "d74eb7a4-9189-47c2-8247-a49576a65744", "value": "49152:TTWmVNLZwnj0MBgRaftBmEnBl4r1FwVmpUOgyS8:TTW40fiGBl30mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918136, "uuid": "e0664acb-1ce7-4ea0-a305-0264c7bd67b7", "value": 1903616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918136, "uuid": "4c19a0f0-40d6-44d6-a418-7b4651b4e734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918136, "uuid": "2a674568-8bd1-4b44-9d58-e2cfdba71ee6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196c8ed8-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743917363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917363, "uuid": "22ec9b37-f7e8-44e1-a1b7-db997d6798e1", "comment": "Malware payload", "value": "c9848047db184507db41c127132c6c09", "object_relation": "md5", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917363, "uuid": "fcef90e3-1f8d-465f-8b71-c1af371794a9", "comment": "Malware payload", "value": "f10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b", "object_relation": "sha256", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917363, "uuid": "769a2c2b-26b8-4d24-a5cc-07a8c2b4e46e", "comment": "Malware payload", "value": "5d33e259113be83c6f7a11be3181e9eebd459486", "object_relation": "sha1", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917363, "uuid": "522e7557-af25-4a89-8250-b19333f7ac3b", "comment": "Malware payload", "value": "59076c7addb85f1a49a9478caa191afdd88989863aeb2863691df8786a60d07ad0c50759faeb926483dba1a14243bede", "object_relation": "sha3-384", "Tag": [ { "name": "api-autodriverfix-online", "colour": "#5AD2FA", "exportable": true, "hide_tag": false }, { "name": "MacOS-Driverfixer", "colour": "#8847C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917363, "uuid": "70a81d56-518f-4b43-979c-64352a5dc01a", "value": "T19921140C5D02C9264631C7229A13A43FFFE05392076B49127738CC19D7793CEEADA6A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917363, "uuid": "367c4bd9-8e98-4894-863a-49ed65b07e0a", "value": "24:zW/JM2kE+qaswVij8QQiLa9FsvsZiP4vyhYGGeK1sERWyXWnyppWs0Jq74GRzdxU:zW/JM2vpjgiLawvsZLem1fRWyXWnyrWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917363, "uuid": "753146fe-d3dd-4a4c-9689-366a66f493fe", "value": 1410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917363, "uuid": "71d4f784-a354-4eec-9297-783a0dbb53b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917363, "uuid": "39463186-61b8-4035-a5c2-22198b9b8109", "value": "update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ed5e47-1289-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743904317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904317, "uuid": "d3f40d6b-0671-4896-abac-b724374466fb", "comment": "Malware payload (SSHdKit)", "value": "f80d4366742c1dfb04f481f82b9118ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904317, "uuid": "c7fff738-17a5-4e1c-8253-88cca8c372a4", "comment": "Malware payload (SSHdKit)", "value": "f437f6976b3e35dc2ae1ebb8d06caac88f5431bd8e9acd09c04e1cdf6e4bfecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904317, "uuid": "616ab0dc-94ef-40d4-b5df-d2b2f21cb043", "comment": "Malware payload (SSHdKit)", "value": "ba87a9c556a6e8a5d4f47d46d0de8eb0d72ee1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743904317, "uuid": "2c39ee24-036d-4f0a-90b2-ef274b2a325b", "comment": "Malware payload (SSHdKit)", "value": "f0fe6cb24b3623a573ba34de52fd48b20af761d89235eee447fe151057e085dbd61396ad06d9b60fc5d3e7b61ca6c522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904317, "uuid": "ee09779a-7019-42c4-9961-9ed15ce39105", "value": "T175356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904317, "uuid": "b96173b3-295b-478e-9c99-2d46ac371646", "value": "12288:E8dASmYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbzsO38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743904317, "uuid": "2dffc2c5-d267-4a70-89f9-bd19fac34080", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743904317, "uuid": "befee6b2-04c9-4c95-bf20-b62b26b5819b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743904317, "uuid": "ebf30ca0-9e1c-42e1-a7ec-07d3b144788b", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda1ae37-12b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743922041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922041, "uuid": "e5cc3e38-d1ed-4221-ac2e-5c8a5138c8ba", "comment": "Malware payload (Mirai)", "value": "9124aad39bdb14f969db6afdb328b324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922041, "uuid": "1af1d77e-7151-429b-9833-97151b7f8117", "comment": "Malware payload (Mirai)", "value": "f49be3b8a42f3901cd040bdefafd7bcec260de8c81187194bc41d32aafe934d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922041, "uuid": "cb3c4564-759e-4055-87b1-ea3d484d70d5", "comment": "Malware payload (Mirai)", "value": "ef0eca0dfc10ce959cede06589341394bcc0a01b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743922041, "uuid": "9330a669-7b71-4e5f-a397-f8d95475090e", "comment": "Malware payload (Mirai)", "value": "64d75110687de6f6120f5dc30f878b34c44a3042c237fc422f324efc38e17cd4728d92180b43aa2ce8bbfa4b880772b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922041, "uuid": "e5fa3889-4641-4164-8565-8484fc40d6b5", "value": "T100A31959B8919F67C6C505BFFE0F868C373653E8E3DA7203DD25AF61368A52A093B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922041, "uuid": "d8a39e08-27c0-4d49-8fc2-293f91549e04", "value": "3072:1qEA1+3u00qTd8S3SMhSXJxiXHpreIiyEvQyli6FYJZalFeldC:lA1oP/Td8W4wZrBqvQUYJAlFe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743922041, "uuid": "c452295f-f196-4d1d-a9fa-98c62975a5fa", "value": 100752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743922041, "uuid": "ae6178ac-d925-43a6-8032-6877388f731f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743922041, "uuid": "c8b06d17-8dd0-4aff-8ada-1e6494fdc2d5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3def6cb-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920656, "uuid": "8c7c0a80-2d25-49c9-9abb-2d81dc41def1", "comment": "Malware payload (LummaStealer)", "value": "36fcb378c74740cdce9f77fd5ac29367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920656, "uuid": "090fc8b4-f2d3-4773-bc7d-5c6a2e858122", "comment": "Malware payload (LummaStealer)", "value": "f4c7e31995b8be248094e79e661bd05a3d85c49a2138932e5bf8cf7ec14cfb89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920656, "uuid": "487bbafc-7440-4f09-9672-ca32f4d08e5d", "comment": "Malware payload (LummaStealer)", "value": "8be54c05e2eb7f5750c25e3566e98534922ca37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920656, "uuid": "d2c034d6-d78c-4008-9f4c-db6f73048be4", "comment": "Malware payload (LummaStealer)", "value": "92074480396d29de8b35250f387e25af2e47d1253a58f595d051525be64b766652ac21bbcb37edcc437a73d354512644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920656, "uuid": "68c787b4-f389-40ee-8e73-3ec76ab6dc1f", "value": "T1D455332277E83257E1AEC7F304037ABC0F79C1923B508ED6D954E752C1589A6F43ACA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920656, "uuid": "24af7f44-c097-4bae-8081-062481c14730", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920656, "uuid": "79da5323-5cf9-4dc1-beab-a933575c24be", "value": "24576:KinYZ9Nzr0I2tm5bu45RCcV4ClHNDVbpkpmiheBFwu8bZlDLQvg3521BbRYKaMTf:ANzg/+2cV42pVbpKKSb3LmbaKac+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920656, "uuid": "8285a096-99ae-4492-9d13-98b0fd0b690a", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920656, "uuid": "da88ee68-dab8-4df9-9525-93cbf4a1bf9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920656, "uuid": "f718215c-fa90-4e2d-9c0e-6f530c01d284", "value": "SecuriteInfo.com.Win32.Evo-gen.6444.11647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ea916d-130d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743961055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743961055, "uuid": "8cc8cc62-457b-4302-bd0c-a6553ad9e40c", "comment": "Malware payload (Prometei)", "value": "184342b0e4d70d3d0f7ee1f61cb8adf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743961055, "uuid": "3626c575-9234-41d4-a7bf-d1b52f80e299", "comment": "Malware payload (Prometei)", "value": "f611434639aa8005a32d4d6a5b226a0a16e3b78204cefdf96897bc788292a370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743961055, "uuid": "2a393b63-9077-44aa-ae01-6bc048ba4185", "comment": "Malware payload (Prometei)", "value": "b34e221f85d594f2c8482194fc53987c4274318b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743961055, "uuid": "6ad5b4d0-9dad-435a-80ce-409e61a52557", "comment": "Malware payload (Prometei)", "value": "6d72411690e1d3b2aa898d5bcc2698c0b613d383db146e91ef1f680cd4189629c5cf5ac2662ba2c7ccb8c7e586008179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743961055, "uuid": "40e51649-66c6-40f7-8f0c-434081c0aecc", "value": "T1B39423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743961055, "uuid": "1d905fb5-f112-4839-855d-f5f1e0769cda", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743961055, "uuid": "4362b500-cc92-43eb-a58c-b7a70691d550", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743961055, "uuid": "50ef8ce9-8fcc-49dc-8ba6-b11c2f0c8c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743961055, "uuid": "c74d623b-d820-4b2d-9b60-915908dd44dc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89a9562-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743934059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934059, "uuid": "5476d228-37be-468c-acdd-3cdc96146645", "comment": "Malware payload (Mirai)", "value": "96e8cbb307135e0590cec0e5fcd9b80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934059, "uuid": "4eb32862-e593-4edd-a717-b69cd9a5ec66", "comment": "Malware payload (Mirai)", "value": "f6156332e0cef3faee0a6de425d5cfbcf73a2a9ee901bdbde613d345770973bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934059, "uuid": "79812d3e-712a-409c-bae8-7fd70065d6b8", "comment": "Malware payload (Mirai)", "value": "45fa9dd4b9d9dea5e45d8bbee5e5d891221b9a99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934059, "uuid": "615257ce-4f88-4d52-8b0a-819a7913474e", "comment": "Malware payload (Mirai)", "value": "cede7af588ace7e00560820964b51efbf61f68fa8292bf621002aac6e2ac29df4b945ffbfb77db937efe1b183a2db7e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934059, "uuid": "aaec3111-4f0e-4d1a-9236-c425e22d204f", "value": "T1AB832903F98540FCC086C6748EAED077DA32F96E26387A5E2784BE212F35E215F2D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934059, "uuid": "b8437b14-8bc0-4147-9483-3eba87522284", "value": "1536:dILi9Lta1G73xb7m7YiueRB6x5TBUJ72XWKcAYYeEPoEQ1It3R+yd5OUWa8itjId:F9Io73RGB4/Y9iVH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934059, "uuid": "f6e83ac8-f492-44f1-bba3-cd8f26f995f3", "value": 83232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934059, "uuid": "8bf21fca-1bde-4245-b72f-8c6d5851a6f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934059, "uuid": "e0506ce4-c463-418e-9b56-35383be40e00", "value": "K5CgAqHhJXCA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33484254-12f8-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1743951767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951767, "uuid": "902e3462-1369-4a0d-b751-45f59cc6cba2", "comment": "Malware payload (XWorm)", "value": "274c8d979d3cb4a652ac711253003255", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951767, "uuid": "3a843e51-cbb1-4d8e-9987-7fbf46ded65c", "comment": "Malware payload (XWorm)", "value": "f6a6c6c6fd7616f6ea65202084c002ecd91c52f6a34675342a83763baa067054", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951767, "uuid": "3a9882cb-dcbf-4936-952d-c11feba97113", "comment": "Malware payload (XWorm)", "value": "11e616571cb7b488be4139fb74073b46aa0c0967", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743951767, "uuid": "e64799b8-4016-4282-b344-745918983e2c", "comment": "Malware payload (XWorm)", "value": "0c383f72ab97072840082c77967daad30cc8d8c45d76fef0b999839aace2b98a2426a286ecf41be865fba076accfcf77", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951767, "uuid": "889ea367-bdb6-43dc-b945-b096775a0fb7", "value": "T1035318323122BDF572BE9D84E20038B1CC85351B63655E7CFB8388592EBA510DEF99E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951767, "uuid": "fea26a5f-16e5-45b0-a132-48cb834e6e2a", "value": "768:5zqJiQ2cHYpy61/rSTF/jerUpYErZXfXE2mZmoTJ35rNevyxZriZ5Rym8IJuQIsg:CBHYU8UpYEr5fXE2m0oVh6Qm8Iw/sq9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743951767, "uuid": "80a58d13-c886-48ca-9afd-3a0c0dd339f1", "value": 64816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743951767, "uuid": "f0b8bcd3-250c-4cfa-a99c-90553220754a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743951767, "uuid": "be3052d5-b18c-4b2c-9804-59d9aad5c36f", "value": "niggers.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d99f1-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1743918140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918140, "uuid": "488eb4ec-48e5-4ef5-a952-15f1dca1b7e8", "comment": "Malware payload (Vidar)", "value": "cbc01fb7800453f31807a3c8c53ce422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918140, "uuid": "b4a709b9-b6db-4f8e-be14-2f18839f2883", "comment": "Malware payload (Vidar)", "value": "f6fbc80ec9718b3ad7fe6f0de73aedf067d1d43a283f677b58ae9f5d283560ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918140, "uuid": "fcd7b348-92e7-4dda-ad23-7bc608a04cfe", "comment": "Malware payload (Vidar)", "value": "a1b48d519d0f4b2d375d2e0f72c8f6076f63f7f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918140, "uuid": "0878f3e3-a198-4bdd-95ed-9e2fab442918", "comment": "Malware payload (Vidar)", "value": "c574ea4695414daa87f6292c2646a3090b85e81959c0eb322759ea6603a82d71ac30e5f0aa9437f0deff9a50913a2561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918140, "uuid": "2275ffb4-c337-488c-9724-69bf158ae407", "value": "T16D74D005B2A548EAED63427E8B529701F5337C278B34DEEF02E446521F17AD81D3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918140, "uuid": "0bd27030-5418-42a4-a8fb-7b7f7be7c004", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918140, "uuid": "9ad117e1-22e1-468a-93b6-f6fbdcdca49d", "value": "6144:oAJvsvm0Pw0soTmUX9ED2sZAZ+Hr8MAC9GVWr2os5Qoh4BdULx83Oy3U4QyKzrL:oAJvsvm4soaUtcLZAZsr8MAOg0Qh+Ke+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918140, "uuid": "9d87acd8-7765-46ec-86c2-84b656c364c8", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918140, "uuid": "5a6bb519-704c-450c-9380-73f3762cae64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918140, "uuid": "f81b8352-cd68-42e2-86fa-6064309a2ec8", "value": "v7942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe0c678-12ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743934044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934044, "uuid": "b3f3ba72-6009-4e4d-9426-3fb8866bc41b", "comment": "Malware payload", "value": "88bc9620107c678c81d9e1a6e60fa964", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934044, "uuid": "49815fdb-5f05-4e89-862f-22d5137c32e0", "comment": "Malware payload", "value": "f81b62401f3c15231ec61daee996faa848b3436a0a9a9b32be808a83fd932ba8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934044, "uuid": "06a58d5f-252b-437b-922f-c52cf5c18a70", "comment": "Malware payload", "value": "051010c21de91d564d108dec809ab43ae2c10dff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743934044, "uuid": "504e7262-30b0-455b-bd51-e2e92224fda8", "comment": "Malware payload", "value": "8d83c558df8a1e2adf61d0e60d98a6ab77e5d4770a37e5a2ab1c74d636221d84af95a0d2614d7535e0f9a3a852d73c0c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934044, "uuid": "bd11607e-8b75-4527-840f-a5621a437326", "value": "T1B011AEF7A2B50BA6095E8D2F7660D64A20C4C79BA32B67ECBC9C282E1E54458B104E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934044, "uuid": "471ae911-7fc4-4b72-bd24-f3b6d840e1c0", "value": "12:h8XSVGjHKLKxMX6NIh5SAt+pooAjigTXRaToK/XA5npXzaG0Fvz4:CXfwKxA6NIfjEp8jigLkToK/XAFlzp8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743934044, "uuid": "3215a33e-acc7-4ce6-803f-029bd0527675", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743934044, "uuid": "e2067811-4804-45f6-b825-754a6fa0bcd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743934044, "uuid": "2fff7db3-27f9-45cf-b692-d2cc4cb779da", "value": "sky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffce4315-1318-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743965854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743965854, "uuid": "1a3ef753-5dcf-40d7-8fcb-e693afaec777", "comment": "Malware payload (Prometei)", "value": "b660417c8374a53b015b5cfbe8f5bf05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743965854, "uuid": "1c0b9552-0a77-4b97-b4a4-ce66c085b664", "comment": "Malware payload (Prometei)", "value": "f891089d0bd3f50f4f50a3c899127da828e8e1030714567cdeed77f838f53839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743965854, "uuid": "e752dcd6-212f-4859-860b-d011b70fe628", "comment": "Malware payload (Prometei)", "value": "738a36381c6ddd402876629eac7bc7652cd7ff08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743965854, "uuid": "2bbf991c-429e-4a83-aea8-9e44c3da1825", "comment": "Malware payload (Prometei)", "value": "1b210176c59d705841d321948c8ecb8be0e9ee5faa36efda617a674a44c4846928d4e475fc58eea6a8d4ad81280b7219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743965854, "uuid": "0817e8b3-279e-4d5c-865a-cb3f5af5f08a", "value": "T1D39423F8C83D2E3098169F3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743965854, "uuid": "aab66abc-e150-43a0-b08b-b1cf04a19c9f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743965854, "uuid": "103bf98d-7754-4e5b-a510-54a81d88757c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743965854, "uuid": "a369a089-e6bb-47e3-ba0f-f765acfd7e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743965854, "uuid": "db7f9384-5c35-4c1e-8a2b-722d9f5f2ab3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a04964-1328-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743972458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972458, "uuid": "10c0e197-5520-47cb-8e2c-639578bb00a7", "comment": "Malware payload (Prometei)", "value": "d9d2c2380d71c90b7432230021c3b1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972458, "uuid": "4594149b-ee69-4c61-95fa-5fddc0e9e8b0", "comment": "Malware payload (Prometei)", "value": "fb016a8400587483e5c48308a3ed58bf55b859d2954117cd3cc0177606ce452c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972458, "uuid": "343fb5b8-c8af-42fe-a4eb-2dbe789d33c2", "comment": "Malware payload (Prometei)", "value": "f05cdd75a7d732c931c09ceedb7664824567f69c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743972458, "uuid": "986fb7f8-51d5-4f20-a09c-4c72a9c89cdf", "comment": "Malware payload (Prometei)", "value": "a2872c50be92fb58eb66ef1b8b2f49df4bbb0c6a408579883def839929d3a2db91a23a8f3a50dbd7e9b29a40a5e8e9da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972458, "uuid": "731bc5cd-2aad-4f74-a04b-9c12ab647f81", "value": "T1779423F8C87D2E30D8169B3CBB1A8268F0A15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972458, "uuid": "bc4dfc63-3464-47c3-b4bc-13193e9e67ce", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743972458, "uuid": "22cb906f-9e72-4915-88dc-8a7581929a2d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743972458, "uuid": "9cd1968d-e899-4d5a-bf25-68042100dd06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743972458, "uuid": "0fc2ac69-4844-4299-8230-3677071a0ac2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a9216f-129e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743913034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913034, "uuid": "a7cd46f1-400a-45ef-9c38-81a393e9b579", "comment": "Malware payload (Prometei)", "value": "bad4783b25c21bcc23c13c4fc01d64ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913034, "uuid": "6cd87269-1060-4d1d-94ec-627d2c2ba6a7", "comment": "Malware payload (Prometei)", "value": "fb7fb0575303159652d0c99d6cbe52469ce8c921d6ffb3395fadad520ad19cbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913034, "uuid": "50d6a3cb-b95c-4be3-9155-215926497a85", "comment": "Malware payload (Prometei)", "value": "0fdc35c9caca9d9036389b11c06bc9b2dafca5e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743913034, "uuid": "1d3c885c-752f-40b6-9430-7aa5f6f81093", "comment": "Malware payload (Prometei)", "value": "c94446253498c73369f995f1cea9391b186473d69d894ac7346f27ac9154ff41a4148f3167e6843f583c045837d10490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913034, "uuid": "e2c5d63a-4868-4e95-bfdf-2535257b0e70", "value": "T14D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913034, "uuid": "6cdc6600-1403-4ef2-84aa-2b5a9f8cbf31", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpll:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743913034, "uuid": "2bea1250-d238-440d-9f91-b597cd699e07", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743913034, "uuid": "ad4791c8-662a-476a-83de-424bf9205b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743913034, "uuid": "3f43d478-dc5d-4829-99d8-ca4a69144359", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf57bfaa-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743920648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920648, "uuid": "41e16b44-8eba-4204-9aee-7acafc31c233", "comment": "Malware payload (Amadey)", "value": "f258ba9ca646b9749d7f22a3dfdc77d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920648, "uuid": "da6d116a-6885-4d36-a12b-2ef7eeefd774", "comment": "Malware payload (Amadey)", "value": "fcc3edcd526b0c746998d72af8ce9cc29b0bd801f767078cc472f93d57eee9ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920648, "uuid": "c70d1f4f-27a1-40af-87e8-b6e82cd84322", "comment": "Malware payload (Amadey)", "value": "36ee4ef9e49e0ebb8973c8f50849d6367c03e69b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920648, "uuid": "263a7475-c307-436b-ae26-39d8fe605d43", "comment": "Malware payload (Amadey)", "value": "5bf64b2f9da1a6b256899a5d528fafa96239321b62ce948310bf5612c0abdf3fdb3923a8262eb29734f127142bbe5292", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920648, "uuid": "a6505b5c-2e3f-4710-83b7-a3418bcf5943", "value": "T1E9251206B2A418E6ED6742BE4B625741E5333D268B31DAEF02F883211F5BED85C3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920648, "uuid": "1149fd53-4af3-46df-aab9-7cfedf76200e", "value": "8beb5ca1ff83475ee16fa1a921765aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920648, "uuid": "c0d1e732-ee50-4b10-93f0-2f31ffe4f0bb", "value": "24576:AwUXFRm7/J2sC0atSlUUQx287txxQ2FWdlpyDd:Aw6I8MgSlfSXtxxx2sDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920648, "uuid": "0b6d88db-825a-4115-9577-e6d30e9b1e69", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920648, "uuid": "b5e10abc-5c21-40e2-9e13-334fa9788beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920648, "uuid": "3ff10298-18d1-4f57-950c-d6455c68f749", "value": "SecuriteInfo.com.Win64.CrypterX-gen.25870.24883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34a5401-12af-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743920628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920628, "uuid": "03a7f0a6-8ac4-4f75-af60-4e848fc503b7", "comment": "Malware payload (LummaStealer)", "value": "3f986040ea150bfb24408c7f5677289d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920628, "uuid": "c5d8dfc2-ff20-4a48-8593-1bca6c7817bd", "comment": "Malware payload (LummaStealer)", "value": "fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920628, "uuid": "4f4df58e-9b28-424a-982b-464d7abbf4eb", "comment": "Malware payload (LummaStealer)", "value": "cee2ff576ec34b152ae9b7390c327fcf931fd372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743920628, "uuid": "d56351fb-f97d-4f73-b5c1-49c349c20637", "comment": "Malware payload (LummaStealer)", "value": "0fd827b2b99c74991248584747845d351f62a7bff036f34472e44c54e130f5a1b3bc2781f0124a89e09bf64c0a240070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920628, "uuid": "66b188de-c9c4-473d-98cb-15244c5226bb", "value": "T10635C014AD7990DAECD740B1776962217433BD378F385AEF00E4C3291956DEE0B3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920628, "uuid": "cd3a43c0-f7ea-4e11-b8cc-f0524bab563e", "value": "3a5649d16d788396ce56dd8cdabd426f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920628, "uuid": "f47f12f7-745f-4231-827b-d2f8ce7d26a2", "value": "24576:Q4HgiyW6cRe30ZD/K/GCbSTdinsxX0zk/Hr+a:QDVUM1uSSTdisxkQHr+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743920628, "uuid": "7b81e899-f49a-4376-ae21-9cc31889f12b", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743920628, "uuid": "bd6910d1-91f5-4112-baf0-bf0118a54fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743920628, "uuid": "21299990-cea8-4bdf-8bb2-34ada57d1212", "value": "SecuriteInfo.com.Win64.CrypterX-gen.793.21937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca15f2-12d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743938579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938579, "uuid": "8e13376a-0edc-49e7-8860-d22864565459", "comment": "Malware payload (Prometei)", "value": "1a2502b46dd0eac83404db68e9187591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938579, "uuid": "30d059ad-a93b-4289-9cd5-4c1386c6b5eb", "comment": "Malware payload (Prometei)", "value": "fdd5518f088b04027b4b36e67218e826e8461f52a1f119024dea74cd7a8c458b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938579, "uuid": "4420318f-dc85-44c0-bfc0-359c05c63e04", "comment": "Malware payload (Prometei)", "value": "70979866eed6817e65053fef4a3c79fe0c55af57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743938579, "uuid": "998f9883-3fc3-45fa-b0ac-06f20568af92", "comment": "Malware payload (Prometei)", "value": "4b7cdebec2925857137352851c2f1faa464b64f898326f1099e2ce2ce8681a4613cfd61c47eae2420e2e60ce352c5d3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938579, "uuid": "78254475-c004-43ef-9e47-94bfe07f1188", "value": "T161155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938579, "uuid": "17728584-1bc0-41f4-acf3-b2bbddc3f82b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplT:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743938579, "uuid": "c03e2af6-6ddf-41b5-880e-148a31b4384d", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743938579, "uuid": "c5c66723-b4d6-4be5-b530-25dc2687b386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743938579, "uuid": "3f36f56c-fa87-4d43-9df5-7b533b91a0ae", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cc76b2-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1743918077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918077, "uuid": "370530b9-41dc-4763-922b-c8fa79bdaf7b", "comment": "Malware payload (Amadey)", "value": "9476089ee6fba4b4b9bafff79b0afef2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918077, "uuid": "f0c6f139-9e42-4397-bdc0-94fefcf1a617", "comment": "Malware payload (Amadey)", "value": "fdfec811dd5f93757f3ea461d6e06a872fae95e1fea78c8d8932968f992698b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918077, "uuid": "22692851-d484-41d0-8e48-1b2c09ecb152", "comment": "Malware payload (Amadey)", "value": "253b4cd213a01ca14a873e71fa3a80dffe43f078", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918077, "uuid": "7e729f53-2a1a-4f10-a47b-131e2eaa42a9", "comment": "Malware payload (Amadey)", "value": "5b6b404d760ea9048f903ccd6229a79340518b45c9a4abe1eb844dd15ddc90ecc5b1e1c1057eaeee867b28919eb70b3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918077, "uuid": "8ef59530-6abe-4c2f-8185-59a49c28712c", "value": "T118953369AD705639DAC3A2738CD3A6888F3178251D63D3ED449A02BD4B677C83FB15E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918077, "uuid": "107b27de-1f78-4fe5-bfea-e804c0d51371", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918077, "uuid": "245fbea9-9450-44c0-87b2-57bdc38b29b5", "value": "49152:6ME9g869C0jlp17OrAR5bX0PoTcomu1eKmfSOPd:hUg3jlH7GAsUSAAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918077, "uuid": "efd26e35-6b33-45fb-88c4-aa750dc17c94", "value": 1927168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918077, "uuid": "d29d7631-552c-4f83-b371-88e922af1a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918077, "uuid": "d5616471-2adf-4711-8447-8e2351d7b89c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7c6ff6-1336-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743978730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978730, "uuid": "3c3ed507-054e-4903-9e9c-827e80021851", "comment": "Malware payload (Mirai)", "value": "d1f0bee87bc065e47d764846f6efac95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978730, "uuid": "5bcc8ee2-b25d-4c06-bdd3-15fa8cd43427", "comment": "Malware payload (Mirai)", "value": "fe7ccc9b6a0e06251dd0b05337dde5930853ab44e877841ab67217f29c53fea7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978730, "uuid": "4dcade89-dc6f-48b2-903c-27112c2243f6", "comment": "Malware payload (Mirai)", "value": "8a99e1d2ae6cd43f5be02aa4c4dbd1ee211d66a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743978730, "uuid": "6442b203-6b54-4df8-9d1b-bf64a41526ef", "comment": "Malware payload (Mirai)", "value": "e8cf26f2999c059f552e6587c51e0b3193c26e4ee3832d526d789d5b24aec0b3a27d8ef80abcd9a6db7041f7fc1ede80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978730, "uuid": "889b357e-b2d5-4e3a-b78d-9d903dc06649", "value": "T118E2F18A88D8AE0ECA6553BC556EBB80FA15B4A42F5F53016ED5CCC2A8033F5F531933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978730, "uuid": "fda58e92-c010-4038-8430-47a01e5f1968", "value": "768:WBbVkTrCrlG46JCSVO0smsL0AjDTK1xtltOX:Kp/ADsLjPK1xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743978730, "uuid": "c84bd25e-0cc6-426e-be87-89cf71ba9168", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743978730, "uuid": "e6acd81a-ed09-45c8-9e87-94b4c84524a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743978730, "uuid": "b2fac99d-b9c2-4a94-8469-15cab79bf3c4", "value": "px86-20250406-2232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7bfcba-12a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743917533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917533, "uuid": "163ae546-4a97-44b8-99db-02e93ad2509a", "comment": "Malware payload (Prometei)", "value": "dcb776bff62e5625cdc06824e61aa469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917533, "uuid": "b0003edc-bc53-4e2f-8870-609d1fc4c488", "comment": "Malware payload (Prometei)", "value": "fec4906fffa941e80358f51bf03c776a9798dd5a5abba5f6f67440655c50c97b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917533, "uuid": "38291e74-c5f0-40c1-90bd-4dad567c75aa", "comment": "Malware payload (Prometei)", "value": "60abee75181b258ba5f38b8b409819440d0b9057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743917533, "uuid": "f89b7ffd-d47a-477e-9cc5-52505679f527", "comment": "Malware payload (Prometei)", "value": "9a34f0c8ccd51d426be7941f3a60f91e097ea58a50dcebec8f92f3e42946c4f9b708d614d0f366c74c08d413e364b936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917533, "uuid": "a3d81f25-988f-4d06-be67-605adb6ac12e", "value": "T162155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917533, "uuid": "eeeba8c5-d92a-4385-b7c9-44de81ed6c75", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplo:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743917533, "uuid": "76ca5482-56c0-441f-8a5a-2b42e6432b26", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743917533, "uuid": "20d092f6-537b-429d-9143-1a925616f8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743917533, "uuid": "8cf69b22-54f3-4b3b-8708-90fea378c661", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e56917-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743918049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918049, "uuid": "7d6f91ea-d4ed-4c99-9adc-3542eec937f2", "comment": "Malware payload", "value": "1d188d4d9366b33254d26cb5fb93d80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918049, "uuid": "786cc2b8-66a3-41c6-a22b-ce50f9f964e9", "comment": "Malware payload", "value": "fee876d2788ed2dc8d891829a99d3e1d92b313a2b23bf623c33042accce3d23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918049, "uuid": "55073fd7-4688-4076-a729-ef7509cf4bfe", "comment": "Malware payload", "value": "2b2f3c26d3dc416c0abfc1c8aa1d850000482ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918049, "uuid": "0598371a-36e6-4c6f-b13a-7dd060385bc7", "comment": "Malware payload", "value": "5e52299c417c919016cd220d0e73453b0bc91ef4ed4abb9d8212018e6af7c574cedefd0e9a1c1b48c0eed68edf1b89ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918049, "uuid": "382e0ce8-daf4-40cd-ad67-2e44ce49bade", "value": "T1D415F2D728A57143C5A5E2F6061E68C70F64FE3E892F253EEECE119041483953E616EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918049, "uuid": "6a19bc16-b549-4110-838b-168f4e83d8cd", "value": "768:dqOg1187U/tpeW/ik9YwnonYxDAB4BL168MeATMwV0OKpd:oOgZtpkUnoYxDAB4368MbV3Kpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918049, "uuid": "107d5853-a9ad-4af2-9438-ab69f95266b5", "value": 923038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918049, "uuid": "e660fc6e-53f2-49e1-8800-f5caa541ca1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918049, "uuid": "30257a68-48fe-4cb1-bb83-05d40f692669", "value": "Photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ed2215-12a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1743918034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918034, "uuid": "87606bc1-dcff-4d24-86ff-26995b5357cb", "comment": "Malware payload (LummaStealer)", "value": "916d48f66a8c1d2072582da6d97444b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918034, "uuid": "8d959c14-cb3e-483d-8176-54d9ff321bb0", "comment": "Malware payload (LummaStealer)", "value": "fef489a3661a1d8bf918ec3864c74974f68ea28c07fad7a0de2c1ba5d6f71b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918034, "uuid": "04b28246-fd90-463e-a41d-e3bad6e33d3f", "comment": "Malware payload (LummaStealer)", "value": "4d988e5807fda11e93a204a5f8e3c7d3a1a36307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743918034, "uuid": "fb629105-6214-4ee1-ad14-79ea665bdff8", "comment": "Malware payload (LummaStealer)", "value": "d006aa81b7f72aef2bf9b80ef1d2b4681e4fef6c5e7e2479792394bbbfa3bf3f0a6340c8bc17723662bd849d88da537f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918034, "uuid": "b482a079-6bab-41f7-bb8b-a28a369bb1fe", "value": "T189A512B8A826ABBAE7CE2471888782D3195A0C2705FE190732DB554163DB1C5D3EF1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918034, "uuid": "5b25b791-2f8c-4582-9763-311980169617", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918034, "uuid": "6506c7ca-8977-4766-bb92-4a2f4a6fe476", "value": "49152:+KFQ4qfpWcQ7oMh3vLStyISxUB7vXxTO1y+qgsDkBcHegWiad/U:+KmJf9CnzyyIS2B7PxK1y+q2LRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743918034, "uuid": "ec352165-daa6-46b9-b595-4cc2efdf99a0", "value": 2137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743918034, "uuid": "7aa4e3ff-a48b-4732-b5da-46789af3c67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743918034, "uuid": "a443d835-dd8b-4f60-ac8f-f5e295146543", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc05c7f0-1340-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743982947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982947, "uuid": "268fce65-297b-4128-b2d8-5571355c59a2", "comment": "Malware payload (Prometei)", "value": "02fac063f1df922a6619a9ec8391ca04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982947, "uuid": "1821cd2c-4733-46db-a825-4fc6a8547b8e", "comment": "Malware payload (Prometei)", "value": "ffd5aec9fec642329b7107bde07110264dac2288b9dceb61438e11bedb68a7d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982947, "uuid": "e3a68f35-900b-4e3a-be9e-7079bb9a091e", "comment": "Malware payload (Prometei)", "value": "b6d797a168771366ca05e6e47e4684665044eb2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743982947, "uuid": "70c88939-8c4c-46cc-ad02-9038c3bec9b6", "comment": "Malware payload (Prometei)", "value": "0b39c67839c0161ae54b315ed8e98b9520586a6ae267d17ed6a8acd9c437a65b29e18b5d92f0706d131db4aaea20f42e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982947, "uuid": "651a66be-1db2-4dbf-b56e-b29d9a2de298", "value": "T1E29423F8C83D2E3098169F3CBB5A826CF0A15772D9562B7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982947, "uuid": "b1754332-e7e4-497f-8c2e-de51c1f89830", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh0:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743982947, "uuid": "58db2db1-0f1d-43c5-82ee-0d2d81b4b608", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743982947, "uuid": "13c5f6c8-0a43-4ac9-9b46-3ea1ff6a5417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743982947, "uuid": "0885b83f-8a35-4cec-9967-4940803bad88", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }